attack.privilege-escalation | Detection.FYI

A Member Was Added to a Security-Enabled Global Group

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects activity when a member is added to a security-enabled global group

Read More
A Member Was Removed From a Security-Enabled Global Group

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects activity when a member is removed from a security-enabled global group

Read More
A New Trust Was Created To A Domain

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Addition of domains is seldom and should be verified for legitimacy.

Read More
A Security-Enabled Global Group Was Deleted

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects activity when a security-enabled global group is deleted

Read More
Abused Debug Privilege by Arbitrary Parent Processes

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1548 ·
Share on:

Detection of unusual child processes by different system processes

Read More
Account Created And Deleted Within A Close Time Frame

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.t1078 ·
Share on:

Detects when an account was created and deleted in a short period of time.

Read More
Account Disabled or Blocked for Sign in Attempts

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078.004 ·
Share on:

Detects when an account is disabled or blocked for sign in but tried to log in

Read More
Add Port Monitor Persistence in Registry

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.010 ·
Share on:

Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.

Read More
Added Credentials to Existing Application

Oct 23, 2025 · attack.privilege-escalation attack.t1098.001 attack.persistence ·
Share on:

Detects when a new credential is added to an existing application. Any additional credentials added outside of expected processes could be a malicious actor using those credentials.

Read More
Addition of SID History to Active Directory Object

Oct 23, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1134.005 ·
Share on:

An attacker can use the SID history attribute to gain additional privileges.

Read More
Admin User Remote Logon

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.lateral-movement attack.initial-access attack.t1078.001 attack.t1078.002 attack.t1078.003 car.2016-04-005 ·
Share on:

Detect remote login by Administrator user (depending on internal pattern).

Read More
Allow Service Access Using Security Descriptor Tampering Via Sc.EXE

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1543.003 ·
Share on:

Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. This can be used to override access restrictions set by previous ACLs.

Read More
Always Install Elevated MSI Spawned Cmd And Powershell

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell"

Read More
Always Install Elevated Windows Installer

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege

Read More
Anomalous User Activity

Oct 23, 2025 · attack.privilege-escalation attack.t1098 attack.persistence ·
Share on:

Indicates that there are anomalous patterns of behavior like suspicious changes to the directory.

Read More
Antivirus PrinterNightmare CVE-2021-34527 Exploit Detection

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1055 detection.emerging-threats ·
Share on:

Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 .

Read More
Application AppID Uri Configuration Changes

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.persistence attack.credential-access attack.privilege-escalation attack.t1552 attack.t1078.004 ·
Share on:

Detects when a configuration change is made to an applications AppID URI.

Read More
Application URI Configuration Changes

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.t1528 attack.t1078.004 attack.persistence attack.credential-access attack.privilege-escalation ·
Share on:

Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.

Read More
APT27 - Emissary Panda Activity

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 attack.g0027 detection.emerging-threats ·
Share on:

Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27

Read More
Aruba Network Service Potential DLL Sideloading

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.persistence attack.t1574.001 ·
Share on:

Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process using DLL Search Order Hijacking

Read More
Atbroker Registry Change

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1218 attack.persistence attack.t1547 ·
Share on:

Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'

Read More
Attempts of Kerberos Coercion Via DNS SPN Spoofing

Oct 23, 2025 · attack.collection attack.credential-access attack.persistence attack.privilege-escalation attack.t1557.001 attack.t1187 ·
Share on:

Detects the presence of "UWhRC....AAYBAAAA" pattern in command line. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like in CVE-2025-33073. If you see this pattern in the command line, it is likely an attempt to add spoofed Service Principal Names (SPNs) to DNS records, or checking for the presence of such records through the nslookup command.

Read More
Authentications To Important Apps Using Single Factor Authentication

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078 ·
Share on:

Detect when authentications to important application(s) only required single-factor authentication

Read More
AWS IAM Backdoor Users Keys

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1098 ·
Share on:

Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS environment. Also with this alert, you can detect a flow of AWS keys in your org.

Read More
AWS IAM S3Browser LoginProfile Creation

Oct 23, 2025 · attack.execution attack.persistence attack.defense-evasion attack.initial-access attack.privilege-escalation attack.t1059.009 attack.t1078.004 ·
Share on:

Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.

Read More
AWS IAM S3Browser Templated S3 Bucket Policy Creation

Oct 23, 2025 · attack.execution attack.t1059.009 attack.persistence attack.defense-evasion attack.initial-access attack.privilege-escalation attack.t1078.004 ·
Share on:

Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "".

Read More
AWS IAM S3Browser User or AccessKey Creation

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.defense-evasion attack.initial-access attack.t1059.009 attack.t1078.004 ·
Share on:

Detects S3 Browser utility creating IAM User or AccessKey.

Read More
AWS Key Pair Import Activity

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations.

Read More
AWS Root Credentials

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.initial-access attack.persistence attack.t1078.004 ·
Share on:

Detects AWS root account usage

Read More
AWS Route 53 Domain Transfer Lock Disabled

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.credential-access attack.t1098 ·
Share on:

Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar.

Read More
AWS Route 53 Domain Transferred to Another Account

Oct 23, 2025 · attack.persistence attack.credential-access attack.privilege-escalation attack.t1098 ·
Share on:

Detects when a request has been made to transfer a Route 53 domain to another AWS account.

Read More
AWS SAML Provider Deletion Activity

Oct 23, 2025 · attack.t1078.004 attack.privilege-escalation attack.defense-evasion attack.initial-access attack.persistence attack.t1531 attack.impact ·
Share on:

Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access. An attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.

Read More
AWS STS AssumeRole Misuse

Oct 23, 2025 · attack.lateral-movement attack.privilege-escalation attack.defense-evasion attack.t1548 attack.t1550 attack.t1550.001 ·
Share on:

Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.

Read More
AWS STS GetSessionToken Misuse

Oct 23, 2025 · attack.lateral-movement attack.privilege-escalation attack.defense-evasion attack.t1548 attack.t1550 attack.t1550.001 ·
Share on:

Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.

Read More
AWS Successful Console Login Without MFA

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1078.004 ·
Share on:

Detects successful AWS console logins that were performed without Multi-Factor Authentication (MFA). This alert can be used to identify potential unauthorized access attempts, as logging in without MFA can indicate compromised credentials or misconfigured security settings.

Read More
AWS Suspicious SAML Activity

Oct 23, 2025 · attack.defense-evasion attack.initial-access attack.lateral-movement attack.persistence attack.privilege-escalation attack.t1078 attack.t1548 attack.t1550 attack.t1550.001 ·
Share on:

Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.

Read More
AWS User Login Profile Was Modified

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1098 ·
Share on:

Detects activity when someone is changing passwords on behalf of other users. An attacker with the "iam:UpdateLoginProfile" permission on other users can change the password used to login to the AWS console on any user that already has a login profile setup.

Read More
Azure AD Only Single Factor Authentication Required

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1078.004 attack.t1556.006 ·
Share on:

Detect when users are authenticating without MFA being required.

Read More
Azure Domain Federation Settings Modified

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078 ·
Share on:

Identifies when an user or application modified the federation settings on the domain.

Read More
Azure Kubernetes Admission Controller

Oct 23, 2025 · attack.privilege-escalation attack.initial-access attack.defense-evasion attack.persistence attack.t1078 attack.credential-access attack.t1552 attack.t1552.007 ·
Share on:

Identifies when an admission controller is executed in Azure Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

Read More
Azure Login Bypassing Conditional Access Policies

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.t1078 ·
Share on:

Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.

Read More
Azure Subscription Permission Elevation Via ActivityLogs

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078.004 ·
Share on:

Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.

Read More
Azure Subscription Permission Elevation Via AuditLogs

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078 ·
Share on:

Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.

Read More
Azure Unusual Authentication Interruption

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078 ·
Share on:

Detects when there is a interruption in the authentication process.

Read More
Bitbucket User Login Failure

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.credential-access attack.t1078.004 attack.t1110 ·
Share on:

Detects user authentication failure events. Please note that this rule can be noisy and it is recommended to use with correlation based on "author.name" field.

Read More
Bitlocker Key Retrieval

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.t1078.004 ·
Share on:

Monitor and alert for Bitlocker key retrieval.

Read More
Bulk Deletion Changes To Privileged Account Permissions

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects when a user is removed from a privileged role. Bulk changes should be investigated.

Read More
Bypass UAC Using Event Viewer

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.010 ·
Share on:

Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification

Read More
Bypass UAC via Fodhelper.exe

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged processes.

Read More
CA Policy Removed by Non Approved Actor

Oct 23, 2025 · attack.privilege-escalation attack.credential-access attack.defense-evasion attack.persistence attack.t1548 attack.t1556 ·
Share on:

Monitor and alert on conditional access changes where non approved actor removed CA Policy.

Read More
CA Policy Updated by Non Approved Actor

Oct 23, 2025 · attack.privilege-escalation attack.credential-access attack.defense-evasion attack.persistence attack.t1548 attack.t1556 ·
Share on:

Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.

Read More
Certificate-Based Authentication Enabled

Oct 23, 2025 · attack.defense-evasion attack.credential-access attack.persistence attack.privilege-escalation attack.t1556 ·
Share on:

Detects when certificate based authentication has been enabled in an Azure Active Directory tenant.

Read More
Change Default File Association To Executable Via Assoc

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.001 ·
Share on:

Detects when a program changes the default file association of any extension to an executable. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.

Read More
Change Default File Association Via Assoc

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.001 ·
Share on:

Detects file association changes using the builtin "assoc" command. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.

Read More
Change to Authentication Method

Oct 23, 2025 · attack.privilege-escalation attack.credential-access attack.t1556 attack.persistence attack.defense-evasion attack.t1098 ·
Share on:

Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.

Read More
Changes To PIM Settings

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.privilege-escalation attack.persistence attack.t1078.004 ·
Share on:

Detects when changes are made to PIM roles

Read More
Changing Existing Service ImagePath Value Via Reg.EXE

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1574.011 ·
Share on:

Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services

Read More
ChromeLoader Malware Execution

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 attack.t1059.001 attack.t1176 detection.emerging-threats ·
Share on:

Detects execution of ChromeLoader malware via a registered scheduled task

Read More
Cisco Local Accounts

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1136.001 attack.t1098 ·
Share on:

Find local accounts being created or modified as well as remote authentication configurations

Read More
Cisco Modify Configuration

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.impact attack.t1490 attack.t1505 attack.t1565.002 attack.t1053 ·
Share on:

Modifications to a config that will serve an adversary's impacts or persistence

Read More
Classes Autorun Keys Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
CobaltStrike Service Installations - Security

Oct 23, 2025 · attack.persistence attack.execution attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·
Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

Read More
CobaltStrike Service Installations - System

Oct 23, 2025 · attack.persistence attack.execution attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·
Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

Read More
Code Injection by ld.so Preload

Oct 23, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.006 ·
Share on:

Detects the ld.so preload persistence file. See man ld.so for more information.

Read More
CodeIntegrity - Blocked Driver Load With Revoked Certificate

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543 ·
Share on:

Detects blocked load attempts of revoked drivers

Read More
CodeIntegrity - Blocked Image/Driver Load For Policy Violation

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543 ·
Share on:

Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity policy.

Read More
COM Hijack via Sdclt

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1546 attack.t1548 ·
Share on:

Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'

Read More
COM Hijacking via TreatAs

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.015 ·
Share on:

Detect modification of TreatAs key to enable "rundll32.exe -sta" command

Read More
COM Object Hijacking Via Modification Of Default System CLSID Default Value

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.015 ·
Share on:

Detects potential COM object hijacking via modification of default system CLSID.

Read More
Common Autorun Keys Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Commvault QLogin with PublicSharingUser and GUID Password (CVE-2025-57788)

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078.001 detection.emerging-threats cve.2025-57788 ·
Share on:

Detects a qlogin.exe command attempting to authenticate as the internal _+_PublicSharingUser_ using a GUID as the password. This could be an indicator of an attacker exploiting CVE-2025-57788 to gain initial access using leaked credentials.

Read More
Control Panel Items

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.defense-evasion attack.t1218.002 attack.persistence attack.t1546 ·
Share on:

Detects the malicious use of a control panel item

Read More
CosmicDuke Service Installation

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1543.003 attack.t1569.002 detection.emerging-threats ·
Share on:

Detects the installation of a service named "javamtsup" on the system. The CosmicDuke info stealer uses Windows services typically named "javamtsup" for persistence.

Read More
Created Files by Microsoft Sync Center

Oct 23, 2025 · attack.privilege-escalation attack.t1055 attack.t1218 attack.execution attack.defense-evasion ·
Share on:

This rule detects suspicious files created by Microsoft Sync Center (mobsync)

Read More
Creation Exe for Service with Unquoted Path

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.009 ·
Share on:

Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.

Read More
Creation of WerFault.exe/Wer.dll in Unusual Folder

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects the creation of a file named "WerFault.exe" or "wer.dll" in an uncommon folder, which could be a sign of WerFault DLL hijacking.

Read More
Credential Dumping Attempt Via Svchost

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1548 ·
Share on:

Detects when a process tries to access the memory of svchost to potentially dump credentials.

Read More
CurrentControlSet Autorun Keys Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
CurrentVersion Autorun Keys Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
CurrentVersion NT Autorun Keys Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
CVE-2022-24527 Microsoft Connected Cache LPE

Oct 23, 2025 · attack.execution attack.privilege-escalation attack.t1059.001 cve.2022-24527 detection.emerging-threats ·
Share on:

Detects files created during the local privilege exploitation of CVE-2022-24527 Microsoft Connected Cache

Read More
Default RDP Port Changed to Non Standard Port

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.010 ·
Share on:

Detects changes to the default RDP port. Remote desktop is a common feature in operating systems. It allows a user to log into a remote system using an interactive session with a graphical user interface. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).

Read More
Defrag Deactivation

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 attack.s0111 detection.emerging-threats ·
Share on:

Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group

Read More
Defrag Deactivation - Security

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053 attack.s0111 detection.emerging-threats ·
Share on:

Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group

Read More
Deny Service Access Using Security Descriptor Tampering Via Sc.EXE

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1543.003 ·
Share on:

Detects suspicious DACL modifications to deny access to a service that affects critical trustees. This can be used to hide services or make them unstoppable.

Read More
Device Registration or Join Without MFA

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.t1078.004 ·
Share on:

Monitor and alert for device registration or join events where MFA was not performed.

Read More
DHCP Callout DLL Installation

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 attack.t1112 ·
Share on:

Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the DHCP server (restart required)

Read More
DHCP Server Error Failed Loading the CallOut DLL

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be loaded

Read More
DHCP Server Loaded the CallOut DLL

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded

Read More
Diamond Sleet APT DLL Sideloading Indicators

Oct 23, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 detection.emerging-threats ·
Share on:

Detects DLL sideloading activity seen used by Diamond Sleet APT

Read More
Direct Autorun Keys Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe.

Read More
Disable ASLR Via Personality Syscall - Linux

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1562.001 attack.t1055.009 ·
Share on:

Detects the use of the personality syscall with the ADDR_NO_RANDOMIZE flag (0x0040000), which disables Address Space Layout Randomization (ASLR) in Linux. This is often used by attackers exploit development, or to bypass memory protection mechanisms. A successful use of this flag can reduce the effectiveness of ASLR and make memory corruption attacks more reliable.

Read More
DLL Execution Via Register-cimprovider.exe

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574 ·
Share on:

Detects using register-cimprovider.exe to execute arbitrary dll file.

Read More
DLL Load via LSASS

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1547.008 ·
Share on:

Detects a method to load DLL via LSASS process using an undocumented Registry key

Read More
DLL Names Used By SVR For GraphicalProton Backdoor

Oct 23, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 detection.emerging-threats ·
Share on:

Hunts known SVR-specific DLL names.

Read More
DLL Sideloading by VMware Xfer Utility

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects execution of VMware Xfer utility (VMwareXferlogs.exe) from the non-default directory which may be an attempt to sideload arbitrary DLL

Read More
Dllhost.EXE Execution Anomaly

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055 ·
Share on:

Detects a "dllhost" process spawning with no commandline arguments which is very rare to happen and could indicate process injection activity or malware mimicking similar system processes.

Read More
DNS Server Error Failed Loading the ServerLevelPluginDLL

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded

Read More
DotNet CLR DLL Loaded By Scripting Applications

Oct 23, 2025 · attack.defense-evasion attack.execution attack.privilege-escalation attack.t1055 ·
Share on:

Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of potential suspicious execution.

Read More
Enabled User Right in AD to Control User Objects

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects.

Read More
ESXi Admin Permission Assigned To Account Via ESXCLI

Oct 23, 2025 · attack.persistence attack.execution attack.privilege-escalation attack.t1059.012 attack.t1098 ·
Share on:

Detects execution of the "esxcli" command with the "system" and "permission" flags in order to assign admin permissions to an account.

Read More
Exploiting SetupComplete.cmd CVE-2019-1378

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1068 attack.execution attack.t1059.003 attack.t1574 cve.2019-1378 detection.emerging-threats ·
Share on:

Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378

Read More
Explorer NOUACCHECK Flag

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

Detects suspicious starts of explorer.exe that use the /NOUACCHECK flag that allows to run all sub processes of that newly started explorer.exe without any UAC checks

Read More
External Remote RDP Logon from Public IP

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1133 attack.t1078 attack.t1110 ·
Share on:

Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.

Read More
External Remote SMB Logon from Public IP

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1133 attack.t1078 attack.t1110 ·
Share on:

Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.

Read More
Failed Authentications From Countries You Do Not Operate Out Of

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 ·
Share on:

Detect failed authentications from countries you do not operate out of.

Read More
Failed Logon From Public IP

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.initial-access attack.persistence attack.t1078 attack.t1190 attack.t1133 ·
Share on:

Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.

Read More
Fax Service DLL Search Order Hijack

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious DLL using this service.

Read More
File Creation In Suspicious Directory By Msdt.EXE

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 cve.2022-30190 ·
Share on:

Detects msdt.exe creating files in suspicious directories which could be a sign of exploitation of either Follina or Dogwalk vulnerabilities

Read More
Forest Blizzard APT - Custom Protocol Handler Creation

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 detection.emerging-threats ·
Share on:

Detects the setting of a custom protocol handler with the name "rogue". Seen being created by Forest Blizzard APT as reported by MSFT.

Read More
Forest Blizzard APT - Custom Protocol Handler DLL Registry Set

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 detection.emerging-threats ·
Share on:

Detects the setting of the DLL that handles the custom protocol handler. Seen being created by Forest Blizzard APT as reported by MSFT.

Read More
GCP Break-glass Container Workload Deployed

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1548 ·
Share on:

Detects the deployment of workloads that are deployed by using the break-glass flag to override Binary Authorization controls.

Read More
Github Outside Collaborator Detected

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.collection attack.t1098.001 attack.t1098.003 attack.t1213.003 ·
Share on:

Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.

Read More
Github SSH Certificate Configuration Changed

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1078.004 ·
Share on:

Detects when changes are made to the SSH certificate configuration of the organization.

Read More
Google Cloud Kubernetes Admission Controller

Oct 23, 2025 · attack.privilege-escalation attack.initial-access attack.defense-evasion attack.persistence attack.t1078 attack.credential-access attack.t1552 attack.t1552.007 ·
Share on:

Identifies when an admission controller is executed in GCP Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

Read More
Google Workspace Granted Domain API Access

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects when an API access service account is granted domain authority.

Read More
Google Workspace User Granted Admin Privileges

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects when an Google Workspace user is granted admin privileges.

Read More
Granting Of Permissions To An Account

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098.003 ·
Share on:

Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.

Read More
Group Policy Abuse for Privilege Addition

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1484.001 ·
Share on:

Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or use them to add users as local admins.

Read More
Guest Account Enabled Via Sysadminctl

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078 attack.t1078.001 ·
Share on:

Detects attempts to enable the guest account using the sysadminctl utility

Read More
Guest User Invited By Non Approved Inviters

Oct 23, 2025 · attack.privilege-escalation attack.initial-access attack.persistence attack.defense-evasion attack.t1078.004 ·
Share on:

Detects when a user that doesn't have permissions to invite a guest user attempts to invite one.

Read More
Guest Users Invited To Tenant By Non Approved Inviters

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078 ·
Share on:

Detects guest users being invited to tenant by non-approved inviters

Read More
HackTool - CACTUSTORCH Remote Thread Creation

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.execution attack.t1055.012 attack.t1059.005 attack.t1059.007 attack.t1218.005 ·
Share on:

Detects remote thread creation from CACTUSTORCH as described in references.

Read More
HackTool - CrackMapExec Execution Patterns

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1047 attack.t1053 attack.t1059.003 attack.t1059.001 attack.s0106 ·
Share on:

Detects various execution patterns of the CrackMapExec pentesting framework

Read More
HackTool - DInjector PowerShell Cradle Execution

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055 ·
Share on:

Detects the use of the Dinject PowerShell cradle based on the specific flags

Read More
HackTool - HollowReaper Execution

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055.012 ·
Share on:

Detects usage of HollowReaper, a process hollowing shellcode launcher used for stealth payload execution through process hollowing. It replaces the memory of a legitimate process with custom shellcode, allowing the attacker to execute payloads under the guise of trusted binaries.

Read More
HackTool - Koh Default Named Pipe

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.credential-access attack.t1528 attack.t1134.001 ·
Share on:

Detects creation of default named pipes used by the Koh tool

Read More
HackTool - LittleCorporal Generated Maldoc Injection

Oct 23, 2025 · attack.defense-evasion attack.execution attack.privilege-escalation attack.t1204.002 attack.t1055.003 ·
Share on:

Detects the process injection of a LittleCorporal generated Maldoc.

Read More
HackTool - NoFilter Execution

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1134 attack.t1134.001 ·
Share on:

Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators

Read More
HackTool - Potential CobaltStrike Process Injection

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055.001 ·
Share on:

Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons

Read More
HackTool - PPID Spoofing SelectMyParent Tool Execution

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1134.004 ·
Share on:

Detects the use of parent process ID spoofing tools like Didier Stevens tool SelectMyParent

Read More
HackTool - SharPersist Execution

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053 ·
Share on:

Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms

Read More
HackTool - SharpUp PrivEsc Tool Execution

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.discovery attack.execution attack.t1615 attack.t1569.002 attack.t1574.005 ·
Share on:

Detects the use of SharpUp, a tool for local privilege escalation

Read More
HAFNIUM Exchange Exploitation Activity

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1546 attack.t1053 attack.g0125 detection.emerging-threats ·
Share on:

Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers

Read More
Increased Failed Authentications Of Any Type

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.t1078 ·
Share on:

Detects when sign-ins increased by 10% or greater.

Read More
Injected Browser Process Spawning Rundll32 - GuLoader Activity

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055 detection.emerging-threats ·
Share on:

Detects the execution of installed GuLoader malware on the host. GuLoader is initiating network connections via the rundll32.exe process that is spawned via a browser parent(injected) process.

Read More
Interactive AT Job

Oct 23, 2025 · attack.persistence attack.execution attack.privilege-escalation attack.t1053.002 ·
Share on:

Detects an interactive AT job, which may be used as a form of privilege escalation.

Read More
Internet Explorer Autorun Keys Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Invalid PIM License

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when an organization doesn't have the proper license for PIM and is out of compliance.

Read More
ISATAP Router Address Was Set

Oct 23, 2025 · attack.impact attack.credential-access attack.collection attack.initial-access attack.privilege-escalation attack.execution attack.t1557 attack.t1565.002 ·
Share on:

Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6. In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic. This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.

Read More
Kapeka Backdoor Autorun Persistence

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 detection.emerging-threats ·
Share on:

Detects the setting of a new value in the Autorun key that is used by the Kapeka backdoor for persistence.

Read More
Kapeka Backdoor Persistence Activity

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 detection.emerging-threats ·
Share on:

Detects Kapeka backdoor persistence activity. Depending on the process privileges, the Kapeka dropper then sets persistence for the backdoor either as a scheduled task (if admin or SYSTEM) or autorun registry (if not). For the scheduled task, it creates a scheduled task called "Sens Api" via schtasks command, which is set to run upon system startup as SYSTEM. To establish persistence through the autorun utility, it adds an autorun entry called "Sens Api" under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run via the "reg add" command. Both persistence mechanisms are set to launch the binary by calling rundll32 and passing the backdoor's first export ordinal (#1) without any additional argument.

Read More
KrbRelayUp Service Installation

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543 ·
Share on:

Detects service creation from KrbRelayUp tool used for privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings)

Read More
Kubernetes Admission Controller Modification

Oct 23, 2025 · attack.privilege-escalation attack.initial-access attack.defense-evasion attack.persistence attack.t1078 attack.credential-access attack.t1552 attack.t1552.007 ·
Share on:

Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.

Read More
Launch Agent/Daemon Execution Via Launchctl

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1569.001 attack.t1543.001 attack.t1543.004 ·
Share on:

Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.

Read More
Lazarus APT DLL Sideloading Activity

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.persistence attack.t1574.001 attack.g0032 detection.emerging-threats ·
Share on:

Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospace company

Read More
Leviathan Registry Key Activity

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 detection.emerging-threats ·
Share on:

Detects registry key used by Leviathan APT in Malaysian focused campaign

Read More
Linux Capabilities Discovery

Oct 23, 2025 · attack.defense-evasion attack.collection attack.privilege-escalation attack.t1123 attack.t1548 ·
Share on:

Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges.

Read More
Linux Doas Conf File Creation

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1548 ·
Share on:

Detects the creation of doas.conf file in linux host platform.

Read More
Linux Doas Tool Execution

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1548 ·
Share on:

Detects the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root, the same way sudo does.

Read More
Login to Disabled Account

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078.004 ·
Share on:

Detect failed attempts to sign in to disabled accounts.

Read More
Logon from a Risky IP Address

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078 ·
Share on:

Detects when a Microsoft Cloud App Security reported when a user signs into your sanctioned apps from a risky IP address.

Read More
Lummac Stealer Activity - Execution Of More.com And Vbc.exe

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055 detection.emerging-threats ·
Share on:

Detects the execution of more.com and vbc.exe in the process tree. This behavior was observed by a set of samples related to Lummac Stealer. The Lummac payload is injected into the vbc.exe process.

Read More
Malicious Driver Load

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 attack.t1068 ·
Share on:

Detects loading of known malicious drivers via their hash.

Read More
Malicious Driver Load By Name

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 attack.t1068 ·
Share on:

Detects loading of known malicious drivers via the file name of the drivers.

Read More
Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.initial-access attack.persistence attack.t1078 attack.t1078.002 ·
Share on:

Detects when an instance identity has taken an action that isn't inside SSM. This can indicate that a compromised EC2 instance is being used as a pivot point.

Read More
ManageEngine Endpoint Central Dctask64.EXE Potential Abuse

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055.001 ·
Share on:

Detects the execution of "dctask64.exe", a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution.

Read More
Measurable Increase Of Successful Authentications

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.t1078 ·
Share on:

Detects when successful sign-ins increased by 10% or greater.

Read More
Meterpreter or Cobalt Strike Getsystem Service Installation - Security

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1134.001 attack.t1134.002 ·
Share on:

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation

Read More
Meterpreter or Cobalt Strike Getsystem Service Installation - System

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1134.001 attack.t1134.002 ·
Share on:

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation

Read More
Microsoft 365 - Impossible Travel Activity

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078 ·
Share on:

Detects when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossible travel.

Read More
Microsoft Defender Blocked from Loading Unsigned DLL

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned DLLs which may be an attempt to sideload arbitrary DLL

Read More
Microsoft Sync Center Suspicious Network Connections

Oct 23, 2025 · attack.privilege-escalation attack.t1055 attack.t1218 attack.execution attack.defense-evasion ·
Share on:

Detects suspicious connections from Microsoft Sync Center to non-private IPs.

Read More
MITRE BZAR Indicators for Execution

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1047 attack.t1053.002 attack.t1569.002 ·
Share on:

Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE

Read More
MITRE BZAR Indicators for Persistence

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.004 ·
Share on:

Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE.

Read More
Modification of ld.so.preload

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.006 ·
Share on:

Identifies modification of ld.so.preload for shared object injection. This technique is used by attackers to load arbitrary code into processes.

Read More
Modifying Crontab

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.003 ·
Share on:

Detects suspicious modification of crontab file.

Read More
MSSQL Extended Stored Procedure Backdoor Maggie

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546 detection.emerging-threats ·
Share on:

This rule detects the execution of the extended storage procedure backdoor named Maggie in the context of Microsoft SQL server

Read More
Multifactor Authentication Denied

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 attack.t1621 ·
Share on:

User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.

Read More
Multifactor Authentication Interrupted

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 attack.t1621 ·
Share on:

Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.

Read More
Narrator's Feedback-Hub Persistence

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects abusing Windows 10 Narrator's Feedback-Hub

Read More
Network Connection Initiated Via Notepad.EXE

Oct 23, 2025 · attack.privilege-escalation attack.command-and-control attack.execution attack.defense-evasion attack.t1055 ·
Share on:

Detects a network connection that is initiated by the "notepad.exe" process. This might be a sign of process injection from a beacon process or something similar. Notepad rarely initiates a network communication except when printing documents for example.

Read More
New ActiveScriptEventConsumer Created Via Wmic.EXE

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.003 ·
Share on:

Detects WMIC executions in which an event consumer gets created. This could be used to establish persistence

Read More
New CA Policy by Non-approved Actor

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1548 ·
Share on:

Monitor and alert on conditional access changes.

Read More
New Custom Shim Database Created

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.009 ·
Share on:

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time.

Read More
New DLL Added to AppCertDlls Registry Key

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.009 ·
Share on:

Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs value in the Registry key can be abused to obtain persistence and privilege escalation by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.

Read More
New DLL Added to AppInit_DLLs Registry Key

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.010 ·
Share on:

DLLs that are specified in the AppInit_DLLs value in the Registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll

Read More
New DNS ServerLevelPluginDll Installed

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 attack.t1112 ·
Share on:

Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)

Read More
New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 attack.t1112 ·
Share on:

Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)

Read More
New Netsh Helper DLL Registered From A Suspicious Location

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.007 ·
Share on:

Detects changes to the Netsh registry key to add a new DLL value that is located on a suspicious location. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper

Read More
New Outlook Macro Created

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.command-and-control attack.t1137 attack.t1008 attack.t1546 ·
Share on:

Detects the creation of a macro file for Outlook.

Read More
New PDQDeploy Service - Client Side

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects PDQDeploy service installation on the target system. When a package is deployed via PDQDeploy it installs a remote service on the target machine with the name "PDQDeployRunner-X" where "X" is an integer starting from 1

Read More
New PDQDeploy Service - Server Side

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects a PDQDeploy service installation which indicates that PDQDeploy was installed on the machines. PDQDeploy can be abused by attackers to remotely install packages or execute commands on target machines

Read More
New Root Certificate Authority Added

Oct 23, 2025 · attack.defense-evasion attack.credential-access attack.persistence attack.privilege-escalation attack.t1556 ·
Share on:

Detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication.

Read More
New RUN Key Pointing to Suspicious Folder

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects suspicious new RUN key element pointing to an executable in a suspicious folder

Read More
Number Of Resource Creation Or Deployment Activities

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Number of VM creations or deployment activities occur in Azure via the azureactivity log.

Read More
Office Autorun Keys Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
OilRig APT Activity

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense-evasion attack.t1112 attack.command-and-control attack.t1071.004 detection.emerging-threats ·
Share on:

Detects OilRig activity as reported by Nyotron in their March 2018 report

Read More
OilRig APT Registry Persistence

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense-evasion attack.t1112 attack.command-and-control attack.t1071.004 detection.emerging-threats ·
Share on:

Detects OilRig registry persistence as reported by Nyotron in their March 2018 report

Read More
OilRig APT Schedule Task Persistence - Security

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense-evasion attack.t1112 attack.command-and-control attack.t1071.004 detection.emerging-threats ·
Share on:

Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

Read More
OilRig APT Schedule Task Persistence - System

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense-evasion attack.t1112 attack.command-and-control attack.t1071.004 detection.emerging-threats ·
Share on:

Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

Read More
Okta Admin Role Assigned to an User or Group

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098.003 ·
Share on:

Detects when an the Administrator role is assigned to an user or group.

Read More
Okta Identity Provider Created

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098.001 ·
Share on:

Detects when a new identity provider is created for Okta.

Read More
Okta New Admin Console Behaviours

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078.004 ·
Share on:

Detects when Okta identifies new activity in the Admin Console.

Read More
OpenCanary - SSH Login Attempt

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.initial-access attack.lateral-movement attack.persistence attack.t1133 attack.t1021 attack.t1078 ·
Share on:

Detects instances where an SSH service on an OpenCanary node has had a login attempt.

Read More
OpenCanary - SSH New Connection Attempt

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.initial-access attack.lateral-movement attack.persistence attack.t1133 attack.t1021 attack.t1078 ·
Share on:

Detects instances where an SSH service on an OpenCanary node has had a connection attempt.

Read More
OpenCanary - Telnet Login Attempt

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.command-and-control attack.t1133 attack.t1078 ·
Share on:

Detects instances where a Telnet service on an OpenCanary node has had a login attempt.

Read More
Operation Wocao Activity

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.discovery attack.t1012 attack.defense-evasion attack.t1036.004 attack.t1027 attack.execution attack.t1053.005 attack.t1059.001 detection.emerging-threats ·
Share on:

Detects activity mentioned in Operation Wocao report

Read More
Operation Wocao Activity - Security

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.discovery attack.t1012 attack.defense-evasion attack.t1036.004 attack.t1027 attack.execution attack.t1053.005 attack.t1059.001 detection.emerging-threats ·
Share on:

Detects activity mentioned in Operation Wocao report

Read More
Outlook Macro Execution Without Warning Setting Enabled

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.command-and-control attack.t1137 attack.t1008 attack.t1546 ·
Share on:

Detects the modification of Outlook security setting to allow unprompted execution of macros.

Read More
Password Change on Directory Service Restore Mode (DSRM) Account

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects potential attempts made to set the Directory Services Restore Mode administrator password. The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers. Attackers may change the password in order to obtain persistence.

Read More
Password Reset By User Account

Oct 23, 2025 · attack.privilege-escalation attack.initial-access attack.defense-evasion attack.persistence attack.credential-access attack.t1078.004 ·
Share on:

Detect when a user has reset their password in Azure AD

Read More
Password Set to Never Expire via WMI

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1047 attack.t1098 ·
Share on:

Detects the use of wmic.exe to modify user account settings and explicitly disable password expiration.

Read More
Persistence and Execution at Scale via GPO Scheduled Task

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.lateral-movement attack.t1053.005 ·
Share on:

Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale

Read More
Persistence Via Cron Files

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.003 ·
Share on:

Detects creation of cron file or files in Cron directories which could indicates potential persistence.

Read More
Persistence Via Sticky Key Backdoor

Oct 23, 2025 · attack.persistence attack.t1546.008 attack.privilege-escalation ·
Share on:

By replacing the sticky keys executable with the local admins CMD executable, an attacker is able to access a privileged windows console session without authenticating to the system. When the sticky keys are "activated" the privilleged shell is launched.

Read More
Persistence Via Sudoers Files

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.003 ·
Share on:

Detects creation of sudoers file or files in "sudoers.d" directory which can be used a potential method to persiste privileges for a specific user.

Read More
PIM Alert Setting Changes To Disabled

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1078 ·
Share on:

Detects when PIM alerts are set to disabled.

Read More
PIM Approvals And Deny Elevation

Oct 23, 2025 · attack.persistence attack.initial-access attack.defense-evasion attack.privilege-escalation attack.t1078.004 ·
Share on:

Detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated.

Read More
Pingback Backdoor Activity

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1574.001 detection.emerging-threats ·
Share on:

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

Read More
Pingback Backdoor DLL Loading Activity

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1574.001 detection.emerging-threats ·
Share on:

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

Read More
Pingback Backdoor File Indicators

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1574.001 detection.emerging-threats ·
Share on:

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

Read More
Potential ACTINIUM Persistence Activity

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053 attack.t1053.005 detection.emerging-threats ·
Share on:

Detects specific process parameters as used by ACTINIUM scheduled task persistence creation.

Read More
Potential appverifUI.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "appverifUI.dll"

Read More
Potential AVKkid.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "AVKkid.dll"

Read More
Potential Azure Browser SSO Abuse

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects abusing Azure Browser SSO by requesting OAuth 2.0 refresh tokens for an Azure-AD-authenticated Windows user (i.e. the machine is joined to Azure AD and a user logs in with their Azure AD account) wanting to perform SSO authentication in the browser. An attacker can use this to authenticate to Azure AD in a browser as that user.

Read More
Potential BearLPE Exploitation

Oct 23, 2025 · attack.persistence attack.execution attack.privilege-escalation attack.t1053.005 car.2013-08-001 detection.emerging-threats ·
Share on:

Detects potential exploitation of the BearLPE exploit using Task Scheduler ".job" import arbitrary DACL write\par

Read More
Potential CobaltStrike Service Installations - Registry

Oct 23, 2025 · attack.persistence attack.execution attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1543.003 attack.t1569.002 ·
Share on:

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement.

Read More
Potential COM Object Hijacking Via TreatAs Subkey - Registry

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.015 ·
Share on:

Detects COM object hijacking via TreatAs subkey

Read More
Potential DLL Injection Or Execution Using Tracker.exe

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055.001 ·
Share on:

Detects potential DLL injection and execution using "Tracker.exe"

Read More
Potential DLL Sideloading Of DbgModel.DLL

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "DbgModel.dll"

Read More
Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".

Read More
Potential DLL Sideloading Of MpSvc.DLL

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "MpSvc.dll".

Read More
Potential DLL Sideloading Of MsCorSvc.DLL

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "mscorsvc.dll".

Read More
Potential DLL Sideloading Using Coregen.exe

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1218 attack.t1055 ·
Share on:

Detect usage of the "coregen.exe" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.

Read More
Potential DLL Sideloading Via DeviceEnroller.EXE

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent DLL file is named "ShellChromeAPI.dll". Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

Read More
Potential DLL Sideloading Via VMware Xfer

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects loading of a DLL by the VMware Xfer utility from the non-default directory which may be an attempt to sideload arbitrary DLL

Read More
Potential EACore.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "EACore.dll"

Read More
Potential Edputil.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "edputil.dll"

Read More
Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)

Oct 23, 2025 · attack.privilege-escalation attack.initial-access attack.execution attack.t1059.001 attack.t1059.003 attack.t1068 attack.t1190 cve.2025-54309 detection.emerging-threats ·
Share on:

Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.

Read More
Potential Goopdate.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe

Read More
Potential Initial Access via DLL Search Order Hijacking

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1566 attack.t1566.001 attack.initial-access attack.t1574 attack.t1574.001 attack.defense-evasion ·
Share on:

Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.

Read More
Potential Iviewers.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "iviewers.dll" (OLE/COM Object Interface Viewer)

Read More
Potential KamiKakaBot Activity - Winlogon Shell Persistence

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 detection.emerging-threats ·
Share on:

Detects changes to the "Winlogon" registry key where a process will set the value of the "Shell" to a value that was observed being used by KamiKakaBot samples in order to achieve persistence.

Read More
Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation

Oct 23, 2025 · attack.collection attack.credential-access attack.t1557.003 attack.persistence attack.privilege-escalation ·
Share on:

Detects modifications to DNS records in Active Directory where the Distinguished Name (DN) contains a base64-encoded blob matching the pattern "1UWhRCAAAAA...BAAAA". This pattern corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure, commonly used in Kerberos coercion attacks. Adversaries may exploit this to coerce victim systems into authenticating to attacker-controlled hosts by spoofing SPNs via DNS. It is one of the strong indicators of a Kerberos coercion attack,. where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073. Please investigate the user account that made the changes, as it is likely a low-privileged account that has been compromised.

Read More
Potential Linux Process Code Injection Via DD Utility

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055.009 ·
Share on:

Detects the injection of code by overwriting the memory map of a Linux process using the "dd" Linux command.

Read More
Potential Meterpreter/CobaltStrike Activity

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1134.001 attack.t1134.002 ·
Share on:

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting

Read More
Potential MFA Bypass Using Legacy Client Authentication

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 ·
Share on:

Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack.

Read More
Potential Mfdetours.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "mfdetours.dll". While using "mftrace.exe" it can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

Read More
Potential Mpclient.DLL Sideloading

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.

Read More
Potential Mpclient.DLL Sideloading Via Defender Binaries

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.

Read More
Potential Notepad++ CVE-2025-49144 Exploitation

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.008 cve.2025-49144 detection.emerging-threats ·
Share on:

Detects potential exploitation of CVE-2025-49144, a local privilege escalation vulnerability in Notepad++ installers (v8.8.1 and prior) where the installer calls regsvr32.exe without specifying the full path. This allows an attacker to execute arbitrary code with elevated privileges by placing a malicious regsvr32.exe alongside this Legitimate Notepad++ installer. The vulnerability is triggered when the installer attempts to register the NppShell.dll file, which is a component of Notepad++.

Read More
Potential Persistence Attempt Via Existing Service Tampering

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1543.003 attack.t1574.011 ·
Share on:

Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or killed as a potential method for persistence.

Read More
Potential Persistence Attempt Via Run Keys Using Reg.EXE

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects suspicious command line reg.exe tool adding key to RUN key in Registry

Read More
Potential Persistence Using DebugPath

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.015 ·
Share on:

Detects potential persistence using Appx DebugPath

Read More
Potential Persistence Via App Paths Default Property

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.012 ·
Share on:

Detects changes to the "Default" property for keys located in the \Software\Microsoft\Windows\CurrentVersion\App Paths\ registry. Which might be used as a method of persistence The entries found under App Paths are used primarily for the following purposes. First, to map an application's executable file name to that file's fully qualified path. Second, to prepend information to the PATH environment variable on a per-application, per-process basis.

Read More
Potential Persistence Via AppCompat RegisterAppRestart Layer

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.011 ·
Share on:

Detects the setting of the REGISTERAPPRESTART compatibility layer on an application. This compatibility layer allows an application to register for restart using the "RegisterApplicationRestart" API. This can be potentially abused as a persistence mechanism.

Read More
Potential Persistence Via Logon Scripts - CommandLine

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1037.001 ·
Share on:

Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence

Read More
Potential Persistence Via Logon Scripts - Registry

Oct 23, 2025 · attack.privilege-escalation attack.t1037.001 attack.persistence attack.lateral-movement ·
Share on:

Detects creation of "UserInitMprLogonScript" registry value which can be used as a persistence method by malicious actors

Read More
Potential Persistence Via Microsoft Compatibility Appraiser

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 ·
Share on:

Detects manual execution of the "Microsoft Compatibility Appraiser" task via schtasks. In order to trigger persistence stored in the "\AppCompatFlags\TelemetryController" registry key.

Read More
Potential Persistence Via Netsh Helper DLL - Registry

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.007 ·
Share on:

Detects changes to the Netsh registry key to add a new DLL value. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper

Read More
Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.command-and-control attack.t1137 attack.t1008 attack.t1546 ·
Share on:

Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module

Read More
Potential Persistence Via PlistBuddy

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1543.001 attack.t1543.004 ·
Share on:

Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility

Read More
Potential Persistence Via Powershell Search Order Hijacking - Task

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell "Get-Variable" technique as seen being used in Colibri Loader

Read More
Potential Persistence Via Scrobj.dll COM Hijacking

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.015 ·
Share on:

Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute

Read More
Potential Persistence Via Shim Database In Uncommon Location

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.011 ·
Share on:

Detects the installation of a new shim database where the file is located in a non-default location

Read More
Potential Persistence Via Shim Database Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.011 ·
Share on:

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time

Read More
Potential Pikabot Hollowing Activity

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055.012 detection.emerging-threats ·
Share on:

Detects the execution of rundll32 that leads to the invocation of legitimate Windows binaries. The malware Pikabot has been seen to use this technique for process hollowing through hard-coded Windows binaries

Read More
Potential PlugX Activity

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.s0013 attack.defense-evasion attack.t1574.001 detection.emerging-threats ·
Share on:

Detects the execution of an executable that is typically used by PlugX for DLL side loading starting from an uncommon location

Read More
Potential Privilege Escalation via Local Kerberos Relay over LDAP

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.credential-access attack.t1548 ·
Share on:

Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account. This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges.

Read More
Potential Privilege Escalation via Service Permissions Weakness

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with Medium integrity level

Read More
Potential Process Injection Via Msra.EXE

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055 ·
Share on:

Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics

Read More
Potential PSFactoryBuffer COM Hijacking

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.015 ·
Share on:

Detects changes to the PSFactory COM InProcServer32 registry. This technique was used by RomCom to create persistence storing a malicious DLL.

Read More
Potential Python DLL SideLoading

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of Python DLL files.

Read More
Potential Raspberry Robin Aclui Dll SideLoading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 detection.emerging-threats ·
Share on:

Detects potential sideloading of malicious "aclui.dll" by OleView.This behavior was observed in Raspberry-Robin variants reported by chekpoint research on Feburary 2024.

Read More
Potential Rcdll.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of rcdll.dll

Read More
Potential Registry Persistence Attempt Via DbgManagedDebugger

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1574 ·
Share on:

Detects the addition of the "Debugger" value to the "DbgManagedDebugger" key in order to achieve persistence. Which will get invoked when an application crashes

Read More
Potential Registry Persistence Attempt Via Windows Telemetry

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 ·
Share on:

Detects potential persistence behavior using the windows telemetry registry key. Windows telemetry makes use of the binary CompatTelRunner.exe to run a variety of commands and perform the actual telemetry collections. This binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run. The problem is, it will run any arbitrary command without restriction of location or type.

Read More
Potential RipZip Attack on Startup Folder

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547 ·
Share on:

Detects a phishing attack which expands a ZIP file containing a malicious shortcut. If the victim expands the ZIP file via the explorer process, then the explorer process expands the malicious ZIP file and drops a malicious shortcut redirected to a backdoor into the Startup folder. Additionally, the file name of the malicious shortcut in Startup folder contains {0AFACED1-E828-11D1-9187-B532F1E9575D} meaning the folder shortcut operation.

Read More
Potential RjvPlatform.DLL Sideloading From Default Location

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects loading of "RjvPlatform.dll" by the "SystemResetPlatform.exe" binary which can be abused as a method of DLL side loading since the "$SysReset" directory isn't created by default.

Read More
Potential RjvPlatform.DLL Sideloading From Non-Default Location

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" located in a non-default location.

Read More
Potential RoboForm.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "roboform.dll", a DLL used by RoboForm Password Manager

Read More
Potential Ryuk Ransomware Activity

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 detection.emerging-threats ·
Share on:

Detects Ryuk ransomware activity

Read More
Potential ShellDispatch.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "ShellDispatch.dll"

Read More
Potential SmadHook.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus

Read More
Potential SolidPDFCreator.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "SolidPDFCreator.dll"

Read More
Potential SSH Tunnel Persistence Install Using A Scheduled Task

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1053.005 attack.command-and-control ·
Share on:

Detects the creation of new scheduled tasks via commandline, using Schtasks.exe. This rule detects tasks creating that call OpenSSH, which may indicate the creation of reverse SSH tunnel to the attacker's server.

Read More
Potential Startup Shortcut Persistence Via PowerShell.EXE

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects PowerShell writing startup shortcuts. This procedure was highlighted in Red Canary Intel Insights Oct. 2021, "We frequently observe adversaries using PowerShell to write malicious .lnk files into the startup directory to establish persistence. Accordingly, this detection opportunity is likely to identify persistence mechanisms in multiple threats. In the context of Yellow Cockatoo, this persistence mechanism eventually launches the command-line script that leads to the installation of a malicious DLL"

Read More
Potential Suspicious Activity Using SeCEdit

Oct 23, 2025 · attack.collection attack.discovery attack.persistence attack.defense-evasion attack.credential-access attack.privilege-escalation attack.t1562.002 attack.t1547.001 attack.t1505.005 attack.t1556.002 attack.t1562 attack.t1574.007 attack.t1564.002 attack.t1546.008 attack.t1546.007 attack.t1547.014 attack.t1547.010 attack.t1547.002 attack.t1557 attack.t1082 ·
Share on:

Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

Read More
Potential Vivaldi_elf.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "vivaldi_elf.dll"

Read More
Potential Waveedit.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "waveedit.dll", which is part of the Nero WaveEditor audio editing software.

Read More
Potential WWlib.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "wwlib.dll"

Read More
Potentially Suspicious Child Process of KeyScrambler.exe

Oct 23, 2025 · attack.persistence attack.execution attack.defense-evasion attack.privilege-escalation attack.t1203 attack.t1574.001 ·
Share on:

Detects potentially suspicious child processes of KeyScrambler.exe

Read More
Powershell Create Scheduled Task

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 ·
Share on:

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code

Read More
Powershell LocalAccount Manipulation

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Adversaries may manipulate accounts to maintain access to victim systems. Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups

Read More
PowerShell Web Access Feature Enabled Via DISM

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1548.002 ·
Share on:

Detects the use of DISM to enable the PowerShell Web Access feature, which could be used for remote access and potential abuse

Read More
Powershell WMI Persistence

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1546.003 ·
Share on:

Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription.

Read More
Powerview Add-DomainObjectAcl DCSync AD Extend Right

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Backdooring domain object to grant the rights associated with DCSync to a regular user or machine account using Powerview\Add-DomainObjectAcl DCSync Extended Right cmdlet, will allow to re-obtain the pwd hashes of any user/computer

Read More
Privileged Account Creation

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1078.004 ·
Share on:

Detects when a new admin is created.

Read More
Privileged User Has Been Created

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1136.001 attack.t1098 ·
Share on:

Detects the addition of a new user to a privileged group such as "root" or "sudo"

Read More
ProcessHacker Privilege Elevation

Oct 23, 2025 · attack.persistence attack.execution attack.privilege-escalation attack.t1543.003 attack.t1569.002 ·
Share on:

Detects a ProcessHacker tool that elevated privileges to a very high level

Read More
PUA - Process Hacker Driver Load

Oct 23, 2025 · attack.persistence attack.privilege-escalation cve.2021-21551 attack.t1543 ·
Share on:

Detects driver load of the Process Hacker tool

Read More
PUA - System Informer Driver Load

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543 ·
Share on:

Detects driver load of the System Informer tool

Read More
PwnKit Local Privilege Escalation

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1548.001 ·
Share on:

Detects potential PwnKit exploitation CVE-2021-4034 in auth logs

Read More
Regedit as Trusted Installer

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1548 ·
Share on:

Detects a regedit started with TrustedInstaller privileges or by ProcessHacker.exe

Read More
Registry Persistence Mechanisms in Recycle Bin

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547 ·
Share on:

Detects persistence registry keys for Recycle Bin

Read More
Registry Persistence via Explorer Run Key

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects a possible persistence mechanism using RUN key for Windows Explorer and pointing to a suspicious folder

Read More
Registry-Free Process Scope COR_PROFILER

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1574.012 ·
Share on:

Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR. The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR). These profiliers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR. (Citation: Microsoft Profiling Mar 2017) (Citation: Microsoft COR_PROFILER Feb 2013)

Read More
Regsvr32 DLL Execution With Uncommon Extension

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574 attack.execution ·
Share on:

Detects a "regsvr32" execution where the DLL doesn't contain a common file extension.

Read More
Remote Access Tool Services Have Been Installed - Security

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1543.003 attack.t1569.002 ·
Share on:

Detects service installation of different remote access tools software. These software are often abused by threat actors to perform

Read More
Remote Access Tool Services Have Been Installed - System

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1543.003 attack.t1569.002 ·
Share on:

Detects service installation of different remote access tools software. These software are often abused by threat actors to perform

Read More
Remote Schedule Task Lateral Movement via ATSvc

Oct 23, 2025 · attack.privilege-escalation attack.lateral-movement attack.execution attack.persistence attack.t1053 attack.t1053.002 ·
Share on:

Detects remote RPC calls to create or execute a scheduled task via ATSvc

Read More
Remote Schedule Task Lateral Movement via ITaskSchedulerService

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.lateral-movement attack.t1053 attack.t1053.002 ·
Share on:

Detects remote RPC calls to create or execute a scheduled task

Read More
Remote Schedule Task Lateral Movement via SASec

Oct 23, 2025 · attack.privilege-escalation attack.lateral-movement attack.execution attack.persistence attack.t1053 attack.t1053.002 ·
Share on:

Detects remote RPC calls to create or execute a scheduled task via SASec

Read More
Remote Task Creation via ATSVC Named Pipe

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.lateral-movement attack.persistence car.2013-05-004 car.2015-04-001 attack.t1053.002 ·
Share on:

Detects remote task creation via at.exe or API interacting with ATSVC namedpipe

Read More
Remote Task Creation via ATSVC Named Pipe - Zeek

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.lateral-movement attack.persistence car.2013-05-004 car.2015-04-001 attack.t1053.002 ·
Share on:

Detects remote task creation via at.exe or API interacting with ATSVC namedpipe

Read More
Renamed Vmnat.exe Execution

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects renamed vmnat.exe or portable version that can be used for DLL side-loading

Read More
Renamed ZOHO Dctask64 Execution

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1036 attack.t1055.001 attack.t1202 attack.t1218 ·
Share on:

Detects a renamed "dctask64.exe" execution, a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution.

Read More
Roles Activated Too Frequently

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when the same privilege role has multiple activations by the same user.

Read More
Roles Activation Doesn't Require MFA

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when a privilege role can be activated without performing mfa.

Read More
Roles Are Not Being Used

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when a user has been assigned a privilege role and are not using that role.

Read More
Roles Assigned Outside PIM

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when a privilege role assignment has taken place outside of PIM and may indicate an attack.

Read More
Root Account Enable Via Dsenableroot

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1078 attack.t1078.001 attack.t1078.003 attack.initial-access attack.persistence ·
Share on:

Detects attempts to enable the root account via "dsenableroot"

Read More
RottenPotato Like Attack Pattern

Oct 23, 2025 · attack.collection attack.privilege-escalation attack.credential-access attack.t1557.001 ·
Share on:

Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like

Read More
Scheduled Task Creation Masquerading as System Processes

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 attack.defense-evasion attack.t1036.004 attack.t1036.005 ·
Share on:

Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading as or abusing these processes to execute payloads or maintain persistence.

Read More
Scheduled Task Creation with Curl and PowerShell Execution Combo

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 attack.defense-evasion attack.t1218 attack.command-and-control attack.t1105 ·
Share on:

Detects the creation of a scheduled task using schtasks.exe, potentially in combination with curl for downloading payloads and PowerShell for executing them. This facilitates executing malicious payloads or connecting with C&C server persistently without dropping the malware sample on the host.

Read More
Scheduled Task Executed From A Suspicious Location

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 ·
Share on:

Detects the execution of Scheduled Tasks where the Program being run is located in a suspicious location or it's an unusale program to be run from a Scheduled Task

Read More
Scheduled Task Executed Uncommon LOLBIN

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 ·
Share on:

Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or where it is an unusual program to be run from a Scheduled Task

Read More
Scheduled Task Executing Encoded Payload from Registry

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtask that potentially executes a base64 encoded payload stored in the Windows Registry using PowerShell.

Read More
Scheduled Task Executing Payload from Registry

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.

Read More
Scheduled Task/Job At

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.002 ·
Share on:

Detects the use of at/atd which are utilities that are used to schedule tasks. They are often abused by adversaries to maintain persistence or to perform task scheduling for initial or recurring execution of malicious code

Read More
Scheduled TaskCache Change by Uncommon Program

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053 attack.t1053.005 ·
Share on:

Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious

Read More
Schtasks Creation Or Modification With SYSTEM Privileges

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 ·
Share on:

Detects the creation or update of a scheduled task to run with "NT AUTHORITY\SYSTEM" privileges

Read More
Schtasks From Suspicious Folders

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1053.005 ·
Share on:

Detects scheduled task creations that have suspicious action command and folder combinations

Read More
SCM Database Privileged Operation

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1548 ·
Share on:

Detects non-system users performing privileged operation os the SCM database

Read More
Sdclt Child Processes

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

A General detection for sdclt spawning new processes. This could be an indicator of sdclt being used for bypass UAC techniques.

Read More
Security Support Provider (SSP) Added to LSA Configuration

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.005 ·
Share on:

Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintext passwords stored in Windows.

Read More
Serpent Backdoor Payload Execution Via Scheduled Task

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 attack.t1059.006 detection.emerging-threats ·
Share on:

Detects post exploitation execution technique of the Serpent backdoor. According to Proofpoint, one of the commands that the backdoor ran was via creating a temporary scheduled task using an unusual method. It creates a fictitious windows event and a trigger in which once the event is created, it executes the payload.

Read More
Service Installed By Unusual Client - Security

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543 ·
Share on:

Detects a service installed by a client which has PID 0 or whose parent has PID 0

Read More
Service Installed By Unusual Client - System

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543 ·
Share on:

Detects a service installed by a client which has PID 0 or whose parent has PID 0

Read More
Service Registry Permissions Weakness Check

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1574.011 stp.2a ·
Share on:

Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services

Read More
Service Reload or Start - Linux

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1543.002 ·
Share on:

Detects the start, reload or restart of a service.

Read More
Session Manager Autorun Keys Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 attack.t1546.009 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Setuid and Setgid

Oct 23, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1548.001 ·
Share on:

Detects suspicious change of file privileges with chown and chmod commands

Read More
Setup16.EXE Execution With Custom .Lst File

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.005 ·
Share on:

Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file. These ".lst" file can contain references to external program that "Setup16.EXE" will execute. Attackers and adversaries might leverage this as a living of the land utility.

Read More
Shell Open Registry Keys Manipulation

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1548.002 attack.t1546.001 ·
Share on:

Detects the shell open key manipulation (exefile and ms-settings) used for persistence and the pattern of UAC Bypass using fodhelper.exe, computerdefaults.exe, slui.exe via registry keys (e.g. UACMe 33 or 62)

Read More
Sign-in Failure Due to Conditional Access Requirements Not Met

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1110 attack.t1078.004 ·
Share on:

Define a baseline threshold for failed sign-ins due to Conditional Access failures

Read More
Sign-ins by Unknown Devices

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.t1078.004 ·
Share on:

Monitor and alert for Sign-ins by unknown devices from non-Trusted locations.

Read More
Sign-ins from Non-Compliant Devices

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.t1078.004 ·
Share on:

Monitor and alert for sign-ins where the device was non-compliant.

Read More
Sliver C2 Default Service Installation

Oct 23, 2025 · attack.persistence attack.execution attack.privilege-escalation attack.t1543.003 attack.t1569.002 ·
Share on:

Detects known malicious service installation that appear in cases in which a Sliver implants execute the PsExec commands

Read More
Small Sieve Malware CommandLine Indicator

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1574.001 detection.emerging-threats ·
Share on:

Detects specific command line argument being passed to a binary as seen being used by the malware Small Sieve.

Read More
Special File Creation via Mknod Syscall

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1543.003 ·
Share on:

Detects usage of the mknod syscall to create special files (e.g., character or block devices). Attackers or malware might use mknod to create fake devices, interact with kernel interfaces, or establish covert channels in Linux systems. Monitoring the use of mknod is important because this syscall is rarely used by legitimate applications, and it can be abused to bypass file system restrictions or create backdoors.

Read More
Stale Accounts In A Privileged Role

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when an account hasn't signed in during the past n number of days.

Read More
Startup Folder File Write

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

A General detection for files being created in the Windows startup directory. This could be an indicator of persistence.

Read More
Startup/Logon Script Added to Group Policy Object

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1484.001 attack.t1547 ·
Share on:

Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.

Read More
StoneDrill Service Install

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.g0064 attack.t1543.003 detection.emerging-threats ·
Share on:

This method detects a service install of the malicious Microsoft Network Realtime Inspection Service service described in StoneDrill report by Kaspersky

Read More
Successful Authentications From Countries You Do Not Operate Out Of

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 ·
Share on:

Detect successful authentications from countries you do not operate out of.

Read More
Sudo Privilege Escalation CVE-2019-14287

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1068 attack.t1548.003 cve.2019-14287 ·
Share on:

Detects users trying to exploit sudo vulnerability reported in CVE-2019-14287

Read More
Sudo Privilege Escalation CVE-2019-14287 - Builtin

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1068 attack.t1548.003 cve.2019-14287 ·
Share on:

Detects users trying to exploit sudo vulnerability reported in CVE-2019-14287

Read More
Suspicious Autorun Registry Modified via WMI

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1547.001 attack.t1047 ·
Share on:

Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is often indicative of persistence mechanisms employed by malware.

Read More
Suspicious Child Process Created as System

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1134.002 ·
Share on:

Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE accounts

Read More
Suspicious Command Patterns In Scheduled Task Creation

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1053.005 ·
Share on:

Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands

Read More
Suspicious Computer Account Name Change CVE-2021-42287

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1036 attack.t1098 cve.2021-42287 detection.emerging-threats ·
Share on:

Detects the renaming of an existing computer account to a account name that doesn't contain a $ symbol as seen in attacks against CVE-2021-42287

Read More
Suspicious Computer Machine Password by PowerShell

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078 ·
Share on:

The Reset-ComputerMachinePassword cmdlet changes the computer account password that the computers use to authenticate to the domain controllers in the domain. You can use it to reset the password of the local computer.

Read More
Suspicious desktop.ini Action

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.009 ·
Share on:

Detects unusual processes accessing desktop.ini, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.

Read More
Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing

Oct 23, 2025 · attack.collection attack.credential-access attack.persistence attack.privilege-escalation attack.t1557.001 attack.t1187 ·
Share on:

Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.

Read More
Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network

Oct 23, 2025 · attack.collection attack.credential-access attack.persistence attack.privilege-escalation attack.t1557.001 attack.t1187 ·
Share on:

Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.

Read More
Suspicious Driver Install by pnputil.exe

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547 ·
Share on:

Detects when a possible suspicious driver is being installed via pnputil.exe lolbin

Read More
Suspicious Encoded Scripts in a WMI Consumer

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.t1047 attack.persistence attack.t1546.003 ·
Share on:

Detects suspicious encoded payloads in WMI Event Consumers

Read More
Suspicious Get-Variable.exe Creation

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546 attack.defense-evasion attack.t1027 ·
Share on:

Get-Variable is a valid PowerShell cmdlet WindowsApps is by default in the path where PowerShell is executed. So when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet.

Read More
Suspicious GrpConv Execution

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547 ·
Share on:

Detects the suspicious execution of a utility to convert Windows 3.x .grp files or for persistence purposes by malicious software or actors

Read More
Suspicious GUP Usage

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects execution of the Notepad++ updater in a suspicious directory, which is often used in DLL side-loading attacks

Read More
Suspicious Modification Of Scheduled Tasks

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1053.005 ·
Share on:

Detects when an attacker tries to modify an already existing scheduled tasks to run from a suspicious location Attackers can create a simple looking task in order to avoid detection on creation as it's often the most focused on Instead they modify the task after creation to include their malicious payload

Read More
Suspicious Outlook Macro Created

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.command-and-control attack.t1137 attack.t1008 attack.t1546 ·
Share on:

Detects the creation of a macro file for Outlook.

Read More
Suspicious PowerShell In Registry Run Keys

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects potential PowerShell commands or code within registry run keys

Read More
Suspicious Printer Driver Empty Manufacturer

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574 cve.2021-1675 ·
Share on:

Detects a suspicious printer driver installation with an empty Manufacturer value

Read More
Suspicious RazerInstaller Explorer Subprocess

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1553 detection.emerging-threats ·
Share on:

Detects a explorer.exe sub process of the RazerInstaller software which can be invoked from the installer to select a different installation folder but can also be exploited to escalate privileges to LOCAL SYSTEM

Read More
Suspicious Remote Logon with Explicit Credentials

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.t1078 attack.lateral-movement ·
Share on:

Detects suspicious processes logging on with explicit credentials

Read More
Suspicious Run Key from Download

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directories

Read More
Suspicious Rundll32 Invoking Inline VBScript

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055 ·
Share on:

Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by UNC2452

Read More
Suspicious Scheduled Task Creation Involving Temp Folder

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 ·
Share on:

Detects the creation of scheduled tasks that involves a temporary folder and runs only once

Read More
Suspicious Scheduled Task Creation via Masqueraded XML File

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.defense-evasion attack.persistence attack.t1036.005 attack.t1053.005 ·
Share on:

Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior could be indicative of potential defense evasion attempt during persistence

Read More
Suspicious Scheduled Task Name As GUID

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1053.005 ·
Share on:

Detects creation of a scheduled task with a GUID like name

Read More
Suspicious Scheduled Task Write to System32 Tasks

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1053 ·
Share on:

Detects the creation of tasks from processes executed from suspicious locations

Read More
Suspicious Schtasks Execution AppData Folder

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtask that executes a file from C:\Users<USER>\AppData\Local

Read More
Suspicious Schtasks Schedule Type With High Privileges

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1053.005 ·
Share on:

Detects scheduled task creations or modification to be run with high privileges on a suspicious schedule type

Read More
Suspicious Schtasks Schedule Types

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.t1053.005 ·
Share on:

Detects scheduled task creations or modification on a suspicious schedule type

Read More
Suspicious ScreenSave Change by Reg.exe

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1546.002 ·
Share on:

Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension

Read More
Suspicious Screensaver Binary File Creation

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.002 ·
Share on:

Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension

Read More
Suspicious Service DACL Modification Via Set-Service Cmdlet

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1543.003 ·
Share on:

Detects suspicious DACL modifications via the "Set-Service" cmdlet using the "SecurityDescriptorSddl" flag (Only available with PowerShell 7) that can be used to hide services or make them unstopable

Read More
Suspicious Shim Database Patching Activity

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.011 ·
Share on:

Detects installation of new shim databases that try to patch sections of known processes for potential process injection or persistence.

Read More
Suspicious SignIns From A Non Registered Device

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.initial-access attack.defense-evasion attack.t1078 ·
Share on:

Detects risky authentication from a non AD registered device without MFA being required.

Read More
Suspicious Startup Folder Persistence

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.t1204.002 attack.persistence attack.t1547.001 ·
Share on:

Detects the creation of potentially malicious script and executable files in Windows startup folders, which is a common persistence technique used by threat actors. These files (.ps1, .vbs, .js, .bat, etc.) are automatically executed when a user logs in, making the Startup folder an attractive target for attackers. This technique is frequently observed in malvertising campaigns and malware distribution where attackers attempt to maintain long-term access to compromised systems.

Read More
Suspicious Unsigned Thor Scanner Execution

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects loading and execution of an unsigned thor scanner binary.

Read More
Suspicious Userinit Child Process

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055 ·
Share on:

Detects a suspicious child process of userinit

Read More
Suspicious VBScript UN2452 Pattern

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 detection.emerging-threats ·
Share on:

Detects suspicious inline VBScript keywords as used by UNC2452

Read More
Sysinternals PsService Execution

Oct 23, 2025 · attack.privilege-escalation attack.discovery attack.persistence attack.t1543.003 ·
Share on:

Detects usage of Sysinternals PsService which can be abused for service reconnaissance and tampering

Read More
Sysinternals PsSuspend Execution

Oct 23, 2025 · attack.privilege-escalation attack.discovery attack.persistence attack.t1543.003 ·
Share on:

Detects usage of Sysinternals PsSuspend which can be abused to suspend critical processes

Read More
System Scripts Autorun Keys Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Systemd Service Creation

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1543.002 ·
Share on:

Detects a creation of systemd services which could be used by adversaries to execute malicious code.

Read More
TAIDOOR RAT DLL Load

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.execution attack.t1055.001 detection.emerging-threats ·
Share on:

Detects specific process characteristics of Chinese TAIDOOR RAT malware load

Read More
Tasks Folder Evasion

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.execution attack.t1574.001 ·
Share on:

The Tasks folder in system32 and syswow64 are globally writable paths. Adversaries can take advantage of this and load or influence any script hosts or ANY .NET Application in Tasks to load and execute a custom assembly into cscript, wscript, regsvr32, mshta, eventvwr

Read More
Temporary Access Pass Added To An Account

Oct 23, 2025 · attack.privilege-escalation attack.initial-access attack.defense-evasion attack.persistence attack.t1078.004 ·
Share on:

Detects when a temporary access pass (TAP) is added to an account. TAPs added to priv accounts should be investigated

Read More
Too Many Global Admins

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies an event where there are there are too many accounts assigned the Global Administrator role.

Read More
Triple Cross eBPF Rootkit Default Persistence

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.defense-evasion attack.t1053.003 ·
Share on:

Detects the creation of "ebpfbackdoor" files in both "cron.d" and "sudoers.d" directories. Which both are related to the TripleCross persistence method

Read More
Trusted Path Bypass via Windows Directory Spoofing

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.007 attack.t1548.002 ·
Share on:

Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g "C:\Windows \System32") which can bypass Windows trusted path verification. This technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC.

Read More
TrustedPath UAC Bypass Pattern

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

Detects indicators of a UAC bypass method by mocking directories

Read More
Turla Group Commands May 2020

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.g0010 attack.execution attack.t1059.001 attack.t1053.005 attack.t1027 detection.emerging-threats ·
Share on:

Detects commands used by Turla group as reported by ESET in May 2020

Read More
Turla PNG Dropper Service

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.g0010 attack.t1543.003 detection.emerging-threats ·
Share on:

This method detects malicious services mentioned in Turla PNG dropper report by NCC Group in November 2018

Read More
Turla Service Install

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.g0010 attack.t1543.003 detection.emerging-threats ·
Share on:

This method detects a service install of malicious services mentioned in Carbon Paper - Turla report by ESET

Read More
UAC Bypass via Windows Firewall Snap-In Hijack

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1548 ·
Share on:

Detects attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in

Read More
Uncommon Userinit Child Process

Oct 23, 2025 · attack.privilege-escalation attack.t1037.001 attack.persistence ·
Share on:

Detects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for persistence.

Read More
Unix Shell Configuration Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.004 ·
Share on:

Detect unix shell configuration modification. Adversaries may establish persistence through executing malicious commands triggered when a new shell is opened.

Read More
Unsigned Binary Loaded From Suspicious Location

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects Code Integrity (CI) engine blocking processes from loading unsigned DLLs residing in suspicious locations

Read More
Unsigned Mfdetours.DLL Sideloading

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

Read More
Unsigned Module Loaded by ClickOnce Application

Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.persistence attack.t1574.001 ·
Share on:

Detects unsigned module load by ClickOnce application.

Read More
Use Of Hidden Paths Or Files

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects calls to hidden files or files located in hidden directories in NIX systems.

Read More
Use of Legacy Authentication Protocols

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 ·
Share on:

Alert on when legacy authentication has been used on an account

Read More
User Access Blocked by Azure Conditional Access

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.credential-access attack.initial-access attack.t1110 attack.t1078.004 ·
Share on:

Detect access has been blocked by Conditional Access policies. The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts.

Read More
User Added To Admin Group Via Dscl

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.initial-access attack.privilege-escalation attack.t1078.003 ·
Share on:

Detects attempts to create and add an account to the admin group via "dscl"

Read More
User Added To Admin Group Via DseditGroup

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.initial-access attack.privilege-escalation attack.t1078.003 ·
Share on:

Detects attempts to create and/or add an account to the admin group, thus granting admin privileges.

Read More
User Added To Admin Group Via Sysadminctl

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.initial-access attack.privilege-escalation attack.t1078.003 ·
Share on:

Detects attempts to create and add an account to the admin group via "sysadminctl"

Read More
User Added to an Administrator's Azure AD Role

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1098.003 attack.t1078 ·
Share on:

User Added to an Administrator's Azure AD Role

Read More
User Added To Group With CA Policy Modification Access

Oct 23, 2025 · attack.privilege-escalation attack.credential-access attack.defense-evasion attack.persistence attack.t1548 attack.t1556 ·
Share on:

Monitor and alert on group membership additions of groups that have CA policy modification access

Read More
User Added To Highly Privileged Group

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects addition of users to highly privileged groups via "Net" or "Add-LocalGroupMember".

Read More
User Added to Local Administrator Group

Oct 23, 2025 · attack.initial-access attack.defense-evasion attack.privilege-escalation attack.t1078 attack.persistence attack.t1098 ·
Share on:

Detects the addition of a new member to the local administrator group, which could be legitimate activity or a sign of privilege escalation activity

Read More
User Added to Local Administrators Group

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1098 ·
Share on:

Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember".

Read More
User Added To Privilege Role

Oct 23, 2025 · attack.persistence attack.initial-access attack.privilege-escalation attack.defense-evasion attack.t1078.004 ·
Share on:

Detects when a user is added to a privileged role.

Read More
User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess'

Oct 23, 2025 · attack.credential-access attack.lateral-movement attack.privilege-escalation attack.t1558.003 ·
Share on:

The 'LsaRegisterLogonProcess' function verifies that the application making the function call is a logon process by checking that it has the SeTcbPrivilege privilege set. Possible Rubeus tries to get a handle to LSA.

Read More
User Removed From Group With CA Policy Modification Access

Oct 23, 2025 · attack.privilege-escalation attack.credential-access attack.defense-evasion attack.persistence attack.t1548 attack.t1556 ·
Share on:

Monitor and alert on group membership removal of groups that have CA policy modification access

Read More
User State Changed From Guest To Member

Oct 23, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access attack.t1078.004 ·
Share on:

Detects the change of user type from "Guest" to "Member" for potential elevation of privilege.

Read More
Users Added to Global or Device Admin Roles

Oct 23, 2025 · attack.persistence attack.initial-access attack.defense-evasion attack.privilege-escalation attack.t1078.004 ·
Share on:

Monitor and alert for users added to device admin roles.

Read More
Users Authenticating To Other Azure AD Tenants

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078.004 ·
Share on:

Detect when users in your Azure AD tenant are authenticating to other Azure AD Tenants.

Read More
Using SettingSyncHost.exe as LOLBin

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.execution attack.defense-evasion attack.t1574.008 ·
Share on:

Detects using SettingSyncHost.exe to run hijacked binary

Read More
VBScript Payload Stored in Registry

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects VBScript content stored into registry keys as seen being used by UNC2452 group

Read More
Vulnerable Driver Load

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 attack.t1068 ·
Share on:

Detects loading of known vulnerable drivers via their hash.

Read More
Vulnerable Driver Load By Name

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 attack.t1068 ·
Share on:

Detects the load of known vulnerable drivers via the file name of the drivers.

Read More
Vulnerable HackSys Extreme Vulnerable Driver Load

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects the load of HackSys Extreme Vulnerable Driver which is an intentionally vulnerable Windows driver developed for security enthusiasts to learn and polish their exploitation skills at Kernel level and often abused by threat actors

Read More
Vulnerable Netlogon Secure Channel Connection Allowed

Oct 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1548 ·
Share on:

Detects that a vulnerable Netlogon secure channel connection was allowed, which could be an indicator of CVE-2020-1472.

Read More
Vulnerable WinRing0 Driver Load

Oct 23, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects the load of a signed WinRing0 driver often used by threat actors, crypto miners (XMRIG) or malware for privilege escalation

Read More
Win Susp Computer Name Containing Samtheadmin

Oct 23, 2025 · attack.initial-access attack.defense-evasion cve.2021-42278 cve.2021-42287 attack.persistence attack.privilege-escalation attack.t1078 ·
Share on:

Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool

Read More
Windows Event Log Access Tampering Via Registry

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1547.001 attack.t1112 ·
Share on:

Detects changes to the Windows EventLog channel permission values. It focuses on changes to the Security Descriptor Definition Language (SDDL) string, as modifications to these values can restrict access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel. Upon execution, the user shouldn't be able to access the event log channel via the event viewer or via utilities such as "Get-EventLog" or "wevtutil".

Read More
Windows Network Access Suspicious desktop.ini Action

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.009 ·
Share on:

Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.

Read More
Windows Terminal Profile Settings Modification By Uncommon Process

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.015 ·
Share on:

Detects the creation or modification of the Windows Terminal Profile settings file "settings.json" by an uncommon process.

Read More
WINEKEY Registry Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547 ·
Share on:

Detects potential malicious modification of run keys by winekey or team9 backdoor

Read More
Winlogon Helper DLL

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.004 ·
Share on:

Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\Software[Wow6432Node]Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are used to manage additional helper programs and functionalities that support Winlogon. Malicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables.

Read More
Winlogon Notify Key Logon Persistence

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.004 ·
Share on:

Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete.

Read More
Winnti Malware HK University Campaign

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 attack.g0044 detection.emerging-threats ·
Share on:

Detects specific process characteristics of Winnti malware noticed in Dec/Jan 2020 in a campaign against Honk Kong universities

Read More
Winnti Pipemon Characteristics

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 attack.g0044 detection.emerging-threats ·
Share on:

Detects specific process characteristics of Winnti Pipemon malware reported by ESET

Read More
WinRAR Creating Files in Startup Locations

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects WinRAR creating files in Windows startup locations, which may indicate an attempt to establish persistence by adding malicious files to the Startup folder. This kind of behaviour has been associated with exploitation of WinRAR path traversal vulnerability CVE-2025-6218 or CVE-2025-8088.

Read More
WinSock2 Autorun Keys Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
WMI Backdoor Exchange Transport Agent

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.003 ·
Share on:

Detects a WMI backdoor in Exchange Transport Agents via WMI event filters

Read More
WMI Event Subscription

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1546.003 ·
Share on:

Detects creation of WMI event subscription persistence method

Read More
WMI Persistence - Command Line Event Consumer

Oct 23, 2025 · attack.privilege-escalation attack.t1546.003 attack.persistence ·
Share on:

Detects WMI command line event consumers

Read More
WMI Persistence - Script Event Consumer File Write

Oct 23, 2025 · attack.privilege-escalation attack.t1546.003 attack.persistence ·
Share on:

Detects file writes of WMI script event consumer

Read More
Wow6432Node Classes Autorun Keys Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Wow6432Node CurrentVersion Autorun Keys Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Wow6432Node Windows NT CurrentVersion Autorun Keys Modification

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 ·
Share on:

Detects modification of autostart extensibility point (ASEP) in registry.

Read More
Writing Local Admin Share

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.lateral-movement attack.t1546.002 ·
Share on:

Aversaries may use to interact with a remote network share using Server Message Block (SMB). This technique is used by post-exploitation frameworks.

Read More
Xwizard.EXE Execution From Non-Default Location

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1574.001 ·
Share on:

Detects the execution of Xwizard tool from a non-default directory. When executed from a non-default directory, this utility can be abused in order to side load a custom version of "xwizards.dll".

Read More
Linux Sudo Chroot Execution

Oct 19, 2025 · attack.privilege-escalation attack.t1068 ·
Share on:

Detects the execution of 'sudo' command with '--chroot' option, which is used to change the root directory for command execution. Attackers may use this technique to evade detection and execute commands in a modified environment. This can be part of a privilege escalation strategy, as it allows the execution of commands with elevated privileges in a controlled environment as seen in CVE-2025-32463. While investigating, look out for unusual or unexpected use of 'sudo --chroot' in conjunction with other commands or scripts such as execution from temporary directories or unusual user accounts.

Read More
Non-Standard Nsswitch.Conf Creation - Potential CVE-2025-32463 Exploitation

Oct 19, 2025 · attack.privilege-escalation attack.t1068 cve.2025-32463 detection.emerging-threats ·
Share on:

Detects the creation of nsswitch.conf files in non-standard directories, which may indicate exploitation of CVE-2025-32463. This vulnerability requires an attacker to create a nsswitch.conf in a directory that will be used during sudo chroot operations. When sudo executes, it loads malicious shared libraries from user-controlled locations within the chroot environment, potentially leading to arbitrary code execution and privilege escalation.

Read More
Rare Remote Thread Creation By Uncommon Source Image

Oct 18, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055 ·
Share on:

Detects uncommon processes creating remote threads.

Read More
Account Tampering - Suspicious Failed Logon Reasons

Oct 17, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access attack.t1078 ·
Share on:

This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.

Read More
New Kernel Driver Via SC.EXE

Oct 9, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects creation of a new service (kernel driver) with the type "kernel"

Read More
Potential Antivirus Software DLL Sideloading

Oct 9, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc

Read More
Potential DLL Sideloading Of DBGCORE.DLL

Oct 9, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects DLL sideloading of "dbgcore.dll"

Read More
Potential DLL Sideloading Of DBGHELP.DLL

Oct 9, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "dbghelp.dll"

Read More
Potential JLI.dll Side-Loading

Oct 9, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL side-loading of jli.dll. JLI.dll has been observed being side-loaded by Java processes by various threat actors, including APT41, XWorm, and others in order to load malicious payloads in context of legitimate Java processes.

Read More
Process Creation Using Sysnative Folder

Oct 9, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns)

Read More
HackTool - CoercedPotato Execution

Oct 1, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

Detects the use of CoercedPotato, a tool for privilege escalation

Read More
Certificate Use With No Strong Mapping

Sep 22, 2025 · attack.privilege-escalation ·
Share on:

Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID) This could be a sign of exploitation of the elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping. Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing.

Read More
KDC RC4-HMAC Downgrade CVE-2022-37966

Sep 22, 2025 · attack.privilege-escalation ·
Share on:

Detects the exploitation of a security bypass and elevation of privilege vulnerability with Authentication Negotiation by using weak RC4-HMAC negotiation

Read More
New Service Creation Using Sc.EXE

Sep 22, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects the creation of a new service using the "sc.exe" utility.

Read More
Suspicious Service Installation Script

Aug 28, 2025 · attack.persistence attack.privilege-escalation car.2013-09-005 attack.t1543.003 ·
Share on:

Detects suspicious service installation scripts

Read More
New Federated Domain Added

Aug 14, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1484.002 ·
Share on:

Detects the addition of a new Federated Domain.

Read More
Remote Thread Creation By Uncommon Source Image

Jul 8, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1055 ·
Share on:

Detects uncommon processes creating remote threads.

Read More
Remote Thread Creation In Uncommon Target Image

Jul 8, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1055.003 ·
Share on:

Detects uncommon target processes for remote thread creation

Read More
Suspicious Sysmon as Execution Parent

Jul 8, 2025 · attack.privilege-escalation attack.t1068 cve.2022-41120 detection.emerging-threats ·
Share on:

Detects suspicious process executions in which Sysmon itself is the parent of a process, which could be a sign of exploitation (e.g. CVE-2022-41120)

Read More
Suspicious Child Process Of Wermgr.EXE

Jul 1, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1055 attack.t1036 ·
Share on:

Detects suspicious Windows Error Reporting manager (wermgr.exe) child process

Read More
HKTL - SharpSuccessor Privilege Escalation Tool Execution

Jun 12, 2025 · attack.privilege-escalation attack.t1068 ·
Share on:

Detects the execution of SharpSuccessor, a tool used to exploit the BadSuccessor attack for privilege escalation in WinServer 2025 Active Directory environments. Successful usage of this tool can let the attackers gain the domain admin privileges by exploiting the BadSuccessor vulnerability.

Read More
Potential System DLL Sideloading From Non System Locations

Jun 4, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.).

Read More
Container With A hostPath Mount Created

Jun 4, 2025 · attack.t1611 attack.privilege-escalation ·
Share on:

Detects creation of a container with a hostPath mount. A hostPath volume mounts a directory or a file from the node to the container. Attackers who have permissions to create a new pod in the cluster may create one with a writable hostPath volume and chroot to escape to the underlying node.

Read More
Potential Malicious Usage of CloudTrail System Manager

Jun 4, 2025 · attack.privilege-escalation attack.initial-access attack.t1566 attack.t1566.002 ·
Share on:

Detect when System Manager successfully executes commands against an instance.

Read More
Privileged Container Deployed

Jun 4, 2025 · attack.t1611 attack.privilege-escalation ·
Share on:

Detects the creation of a "privileged" container, an action which could be indicative of a threat actor mounting a container breakout attacks. A privileged container is a container that can access the host with all of the root capabilities of the host machine. This allows it to view, interact and modify processes, network operations, IPC calls, the file system, mount points, SELinux configurations etc. as the root user on the host. Various versions of "privileged" containers can be specified, e.g. by setting the securityContext.privileged flag in the resource specification, setting non-standard Linux capabilities, or configuring the hostNetwork/hostPID fields

Read More
Buffer Overflow Attempts

Jun 4, 2025 · attack.t1068 attack.privilege-escalation ·
Share on:

Detects buffer overflow attempts in Unix system log files

Read More
Kubernetes CronJob/Job Modification

Jun 2, 2025 · attack.persistence attack.privilege-escalation attack.execution ·
Share on:

Detects when a Kubernetes CronJob or Job is created or modified. A Kubernetes Job creates one or more pods to accomplish a specific task, and a CronJob creates Jobs on a recurring schedule. An adversary can take advantage of this Kubernetes object to schedule Jobs to run containers that execute malicious code within a cluster, allowing them to achieve persistence.

Read More
Kubernetes Rolebinding Modification

Jun 2, 2025 · attack.privilege-escalation ·
Share on:

Detects when a Kubernetes Rolebinding is created or modified.

Read More
Suspicious SQL Query

May 20, 2025 · attack.exfiltration attack.initial-access attack.privilege-escalation attack.persistence attack.t1190 attack.t1505.001 ·
Share on:

Detects suspicious SQL query keywrods that are often used during recon, exfiltration or destructive activities. Such as dropping tables and selecting wildcard fields

Read More
Windows LAPS Credential Dump From Entra ID

May 20, 2025 · attack.privilege-escalation attack.persistence attack.t1098.005 ·
Share on:

Detects when an account dumps the LAPS password from Entra ID.

Read More
HackTool - SharpDPAPI Execution

May 20, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1134.001 attack.t1134.003 ·
Share on:

Detects the execution of the SharpDPAPI tool based on CommandLine flags and PE metadata. SharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project.

Read More
Kapeka Backdoor Scheduled Task Creation

May 20, 2025 · attack.execution attack.privilege-escalation attack.persistence attack.t1053.005 detection.emerging-threats ·
Share on:

Detects Kapeka backdoor scheduled task creation based on attributes such as paths, commands line flags, etc.

Read More
Creation Of Non-Existent System DLL

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects the creation of system DLLs that are usually not present on the system (or at least not in system directories). Usually this technique is used to achieve DLL hijacking.

Read More
DLL Search Order Hijackig Via Additional Space in Path

May 15, 2025 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.001 ·
Share on:

Detects when an attacker create a similar folder structure to windows system folders such as (Windows, Program Files...) but with a space in order to trick DLL load search order and perform a "DLL Search Order Hijacking" attack

Read More
DLL Sideloading Of ShellChromeAPI.DLL

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL. Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

Read More
Malicious DLL File Dropped in the Teams or OneDrive Folder

May 15, 2025 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.001 ·
Share on:

Detects creation of a malicious DLL file in the location where the OneDrive or Team applications Upon execution of the Teams or OneDrive application, the dropped malicious DLL file ("iphlpapi.dll") is sideloaded

Read More
Microsoft Office DLL Sideload

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location

Read More
Potential 7za.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "7za.dll"

Read More
Potential CCleanerDU.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "CCleanerDU.dll"

Read More
Potential CCleanerReactivator.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "CCleanerReactivator.dll"

Read More
Potential Chrome Frame Helper DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "chrome_frame_helper.dll"

Read More
Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "libcurl.dll" by the "gup.exe" process from an uncommon location

Read More
Potential DLL Sideloading Of Non-Existent DLLs From System Folders

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects DLL sideloading of system DLLs that are not present on the system by default (at least not in system directories). Usually this technique is used to achieve UAC bypass or privilege escalation.

Read More
Potential DLL Sideloading Via ClassicExplorer32.dll

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software

Read More
Potential DLL Sideloading Via comctl32.dll

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading using comctl32.dll to obtain system privileges

Read More
Potential DLL Sideloading Via JsSchHlp

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading using JUSTSYSTEMS Japanese word processor

Read More
Potential Libvlc.DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of "libvlc.dll", a DLL that is legitimately used by "VLC.exe"

Read More
Potential Wazuh Security Platform DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL side loading of DLLs that are part of the Wazuh security platform

Read More
Third Party Software DLL Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects DLL sideloading of DLLs that are part of third party software (zoom, discord....etc)

Read More
UAC Bypass With Fake DLL

May 15, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1548.002 attack.t1574.001 ·
Share on:

Attempts to load dismcore.dll after dropping it

Read More
VMGuestLib DLL Sideload

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service.

Read More
VMMap Signed Dbghelp.DLL Potential Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of a signed dbghelp.dll by the Sysinternals VMMap.

Read More
VMMap Unsigned Dbghelp.DLL Potential Sideloading

May 15, 2025 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 ·
Share on:

Detects potential DLL sideloading of an unsigned dbghelp.dll by the Sysinternals VMMap.

Read More
HackTool - winPEAS Execution

Apr 25, 2025 · attack.privilege-escalation attack.discovery attack.t1082 attack.t1087 attack.t1046 ·
Share on:

WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz

Read More
UAC Notification Disabled

Apr 16, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

Detects when an attacker tries to disable User Account Control (UAC) notification by tampering with the "UACDisableNotify" value. UAC is a critical security feature in Windows that prevents unauthorized changes to the operating system. It prompts the user for permission or an administrator password before allowing actions that could affect the system's operation or change settings that affect other users. When "UACDisableNotify" is set to 1, UAC prompts are suppressed.

Read More
UAC Secure Desktop Prompt Disabled

Apr 16, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

Detects when an attacker tries to change User Account Control (UAC) elevation request destination via the "PromptOnSecureDesktop" value. The "PromptOnSecureDesktop" setting specifically determines whether UAC prompts are displayed on the secure desktop. The secure desktop is a separate desktop environment that's isolated from other processes running on the system. It's designed to prevent malicious software from intercepting or tampering with UAC prompts. When "PromptOnSecureDesktop" is set to 0, UAC prompts are displayed on the user's current desktop instead of the secure desktop. This reduces the level of security because it potentially exposes the prompts to manipulation by malicious software.

Read More
Uncommon Process Access Rights For Target Image

Apr 16, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1055.011 ·
Share on:

Detects process access request to uncommon target images with a "PROCESS_ALL_ACCESS" access mask.

Read More
AWS New Lambda Layer Attached

Apr 7, 2025 · attack.privilege-escalation ·
Share on:

Detects when a user attached a Lambda layer to an existing Lambda function. A malicious Lambda layer could execute arbitrary code in the context of the function's IAM role. This would give an adversary access to resources that the function has access to.

Read More
Elevated System Shell Spawned From Uncommon Parent Location

Apr 7, 2025 · attack.privilege-escalation attack.defense-evasion attack.execution attack.t1059 ·
Share on:

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.

Read More
Kubernetes Unauthorized or Unauthenticated Access

Mar 4, 2025 · attack.privilege-escalation ·
Share on:

Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authentication token being used. This may indicate an attacker attempting to leverage credentials they have obtained.

Read More
Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection

Mar 4, 2025 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion cve.2024-3400 detection.emerging-threats ·
Share on:

Detects potential exploitation attempts of CVE-2024-3400 - an OS command injection in Palo Alto GlobalProtect. This detection looks for suspicious strings that indicate a potential directory traversal attempt or command injection.

Read More
Potential CVE-2024-35250 Exploitation Activity

Feb 24, 2025 · attack.privilege-escalation attack.t1068 cve.2024-35250 detection.emerging-threats ·
Share on:

Detects potentially suspicious loading of "ksproxy.ax", which may indicate an attempt to exploit CVE-2024-35250.

Read More
New TimeProviders Registered With Uncommon DLL Name

Feb 3, 2025 · attack.persistence attack.privilege-escalation attack.t1547.003 ·
Share on:

Detects processes setting a new DLL in DllName in under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider. Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.

Read More
ServiceDll Hijack

Feb 3, 2025 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects changes to the "ServiceDLL" value related to a service in the registry. This is often used as a method of persistence.

Read More
Bitbucket Global Permission Changed

Jan 6, 2025 · attack.persistence attack.privilege-escalation attack.t1098 ·
Share on:

Detects global permissions change activity.

Read More
New AWS Lambda Function URL Configuration Created

Dec 19, 2024 · attack.initial-access attack.privilege-escalation ·
Share on:

Detects when a user creates a Lambda function URL configuration, which could be used to expose the function to the internet and potentially allow unauthorized access to the function's IAM role for AWS API calls. This could give an adversary access to the privileges associated with the Lambda service role that is attached to that function.

Read More
Register new Logon Process by Rubeus

Dec 19, 2024 · attack.lateral-movement attack.privilege-escalation attack.credential-access attack.t1558.003 ·
Share on:

Detects potential use of Rubeus via registered new trusted logon process

Read More
CMSTP UAC Bypass via COM Object Access

Dec 1, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1548.002 attack.t1218.003 attack.g0069 car.2019-04-001 ·
Share on:

Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65)

Read More
Exploiting CVE-2019-1388

Dec 1, 2024 · attack.privilege-escalation attack.t1068 cve.2019-1388 detection.emerging-threats ·
Share on:

Detects an exploitation attempt in which the UAC consent dialogue is used to invoke an Internet Explorer process running as LOCAL_SYSTEM

Read More
Possible Privilege Escalation via Weak Service Permissions

Dec 1, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand

Read More
Potential CVE-2021-41379 Exploitation Attempt

Dec 1, 2024 · attack.privilege-escalation attack.t1068 cve.2021-41379 detection.emerging-threats ·
Share on:

Detects potential exploitation attempts of CVE-2021-41379 (InstallerFileTakeOver), a local privilege escalation (LPE) vulnerability where the attacker spawns a "cmd.exe" process as a child of Microsoft Edge elevation service "elevation_service" with "LOCAL_SYSTEM" rights

Read More
Potential UAC Bypass Via Sdclt.EXE

Dec 1, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for bypass UAC techniques.

Read More
Suspicious SYSTEM User Process Creation

Dec 1, 2024 · attack.credential-access attack.defense-evasion attack.privilege-escalation attack.t1134 attack.t1003 attack.t1027 ·
Share on:

Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

Read More
UAC Bypass Abusing Winsat Path Parsing - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

Read More
UAC Bypass Tools Using ComputerDefaults

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59)

Read More
UAC Bypass Using ChangePK and SLUI

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects an UAC bypass that uses changepk.exe and slui.exe (UACMe 61)

Read More
UAC Bypass Using Consent and Comctl32 - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)

Read More
UAC Bypass Using Disk Cleanup

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using scheduled tasks and variable expansion of cleanmgr.exe (UACMe 34)

Read More
UAC Bypass Using DismHost

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using DismHost DLL hijacking (UACMe 63)

Read More
UAC Bypass Using IDiagnostic Profile

Dec 1, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the "IDiagnosticProfileUAC" UAC bypass technique

Read More
UAC Bypass Using IEInstal - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)

Read More
UAC Bypass Using MSConfig Token Modification - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)

Read More
UAC Bypass Using NTFS Reparse Point - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)

Read More
UAC Bypass Using PkgMgr and DISM

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using pkgmgr.exe and dism.exe (UACMe 23)

Read More
UAC Bypass Using Windows Media Player - Process

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)

Read More
UAC Bypass WSReset

Dec 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass via WSReset usable by default sysmon-config

Read More
GCP Access Policy Deleted

Dec 1, 2024 · attack.persistence attack.privilege-escalation attack.t1098 ·
Share on:

Detects when an access policy that is applied to a GCP cloud resource is deleted. An adversary would be able to remove access policies to gain access to a GCP cloud resource.

Read More
Google Workspace Application Access Level Modified

Dec 1, 2024 · attack.persistence attack.privilege-escalation attack.t1098.003 ·
Share on:

Detects when an access level is changed for a Google workspace application. An access level is part of BeyondCorp Enterprise which is Google Workspace's way of enforcing Zero Trust model. An adversary would be able to remove access levels to gain easier access to Google workspace resources.

Read More
Suspicious Processes Spawned by Java.EXE

Dec 1, 2024 · attack.initial-access attack.persistence attack.privilege-escalation ·
Share on:

Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j)

Read More
HackTool - Impersonate Execution

Nov 25, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1134.001 attack.t1134.003 ·
Share on:

Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

Read More
HackTool - LocalPotato Execution

Nov 25, 2024 · attack.defense-evasion attack.privilege-escalation cve.2023-21746 ·
Share on:

Detects the execution of the LocalPotato POC based on basic PE metadata information and default CLI examples

Read More
HackTool - SysmonEOP Execution

Nov 25, 2024 · cve.2022-41120 attack.t1068 attack.privilege-escalation ·
Share on:

Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120

Read More
HackTool - UACMe Akagi Execution

Nov 25, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the execution of UACMe, a tool used for UAC bypasses, via default PE metadata

Read More
PUA - Process Hacker Execution

Nov 25, 2024 · attack.defense-evasion attack.discovery attack.persistence attack.privilege-escalation attack.t1622 attack.t1564 attack.t1543 ·
Share on:

Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker is a tool to view and manipulate processes, kernel options and other low level options. Threat actors abused older vulnerable versions to manipulate system processes.

Read More
PUA - System Informer Execution

Nov 25, 2024 · attack.persistence attack.privilege-escalation attack.discovery attack.defense-evasion attack.t1082 attack.t1564 attack.t1543 ·
Share on:

Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations

Read More
App Assigned To Azure RBAC/Microsoft Entra Role

Nov 20, 2024 · attack.persistence attack.privilege-escalation attack.t1098.003 ·
Share on:

Detects when an app is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner.

Read More
HackTool - EfsPotato Named Pipe Creation

Nov 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

Detects the pattern of a pipe name as used by the hack tool EfsPotato

Read More
HackTool - WinPwn Execution

Oct 1, 2024 · attack.credential-access attack.defense-evasion attack.discovery attack.execution attack.privilege-escalation attack.t1046 attack.t1082 attack.t1106 attack.t1518 attack.t1548.002 attack.t1552.001 attack.t1555 attack.t1555.003 ·
Share on:

Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Read More
HackTool - WinPwn Execution - ScriptBlock

Oct 1, 2024 · attack.credential-access attack.defense-evasion attack.discovery attack.execution attack.privilege-escalation attack.t1046 attack.t1082 attack.t1106 attack.t1518 attack.t1548.002 attack.t1552.001 attack.t1555 attack.t1555.003 ·
Share on:

Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Read More
Potential Process Hollowing Activity

Oct 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055.012 ·
Share on:

Detects when a memory process image does not match the disk image, indicative of process hollowing.

Read More
Whoami.EXE Execution From Privileged Process

Oct 1, 2024 · attack.privilege-escalation attack.discovery attack.t1033 ·
Share on:

Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors

Read More
CVE-2021-1675 Print Spooler Exploitation Filename Pattern

Sep 13, 2024 · attack.execution attack.privilege-escalation attack.resource-development attack.t1587 cve.2021-1675 detection.emerging-threats ·
Share on:

Detects the default filename used in PoC code against print spooler vulnerability CVE-2021-1675

Read More
InstallerFileTakeOver LPE CVE-2021-41379 File Create Event

Sep 13, 2024 · attack.privilege-escalation attack.t1068 detection.emerging-threats ·
Share on:

Detects signs of the exploitation of LPE CVE-2021-41379 that include an msiexec process that creates an elevation_service.exe file

Read More
Potential PrintNightmare Exploitation Attempt

Sep 13, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574 cve.2021-1675 ·
Share on:

Detect DLL deletions from Spooler Service driver folder. This might be a potential exploitation attempt of CVE-2021-1675

Read More
Windows Spooler Service Suspicious Binary Load

Sep 13, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574 cve.2021-1675 cve.2021-34527 ·
Share on:

Detect DLL Load from Spooler Service backup folder

Read More
Diamond Sleet APT Scheduled Task Creation

Sep 2, 2024 · attack.execution attack.privilege-escalation attack.persistence attack.t1053.005 detection.emerging-threats ·
Share on:

Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability

Read More
Exploitation Indicators Of CVE-2023-20198

Sep 2, 2024 · attack.privilege-escalation attack.initial-access detection.emerging-threats ·
Share on:

Detecting exploitation indicators of CVE-2023-20198 a privilege escalation vulnerability in Cisco IOS XE Software Web UI.

Read More
HackTool - CoercedPotato Named Pipe Creation

Sep 2, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

Detects the pattern of a pipe name as used by the hack tool CoercedPotato

Read More
Abuse of Service Permissions to Hide Services Via Set-Service

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

Read More
Abuse of Service Permissions to Hide Services Via Set-Service - PS

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

Read More
Activity From Anonymous IP Address

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.

Read More
ADCS Certificate Template Configuration Vulnerability

Aug 12, 2024 · attack.privilege-escalation attack.credential-access ·
Share on:

Detects certificate creation with template allowing risk permission subject

Read More
ADCS Certificate Template Configuration Vulnerability with Risky EKU

Aug 12, 2024 · attack.privilege-escalation attack.credential-access ·
Share on:

Detects certificate creation with template allowing risk permission subject and risky EKU

Read More
App Granted Privileged Delegated Or App Permissions

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1098.003 ·
Share on:

Detects when administrator grants either application permissions (app roles) or highly privileged delegated permissions

Read More
Application Using Device Code Authentication Flow

Aug 12, 2024 · attack.t1078 attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access ·
Share on:

Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments. If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted. This can be a misconfigured application or potentially something malicious.

Read More
Applications That Are Using ROPC Authentication Flow

Aug 12, 2024 · attack.t1078 attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access ·
Share on:

Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. The application then uses those credentials to authenticate the user against the identity provider.

Read More
APT PRIVATELOG Image Load Pattern

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 detection.emerging-threats ·
Share on:

Detects an image load pattern as seen when a tool named PRIVATELOG is used and rarely observed under legitimate circumstances

Read More
Atypical Travel

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.

Read More
Audit CVE Event

Aug 12, 2024 · attack.execution attack.t1203 attack.privilege-escalation attack.t1068 attack.defense-evasion attack.t1211 attack.credential-access attack.t1212 attack.lateral-movement attack.t1210 attack.impact attack.t1499.004 ·
Share on:

Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.

Read More
AWS Glue Development Endpoint Activity

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects possible suspicious glue development endpoint activity.

Read More
Azure AD Threat Intelligence

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Indicates user activity that is unusual for the user or consistent with known attack patterns.

Read More
Azure Kubernetes CronJob

Aug 12, 2024 · attack.persistence attack.t1053.003 attack.privilege-escalation attack.execution ·
Share on:

Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

Read More
Bypass UAC Using DelegateExecute

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

Bypasses User Account Control using a fileless method

Read More
Bypass UAC Using SilentCleanup Task

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

Detects the setting of the environement variable "windir" to a non default value. Attackers often abuse this variable in order to trigger a UAC bypass via the "SilentCleanup" task. The SilentCleanup task located in %windir%\system32\cleanmgr.exe is an auto-elevated task that can be abused to elevate any file with administrator privileges without prompting UAC.

Read More
Bypass UAC via CMSTP

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 attack.t1218.003 ·
Share on:

Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install specially formatted local .INF files

Read More
Bypass UAC via WSReset.exe

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

Detects use of WSReset.exe to bypass User Account Control (UAC). Adversaries use this technique to execute privileged processes.

Read More
Changes to Device Registration Policy

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1484 ·
Share on:

Monitor and alert for changes to the device registration policy.

Read More
Cisco BGP Authentication Failures

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects BGP failures which may be indicative of brute force attacks to manipulate routing

Read More
Cisco LDP Authentication Failures

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels

Read More
CobaltStrike Named Pipe

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

Detects the creation of a named pipe as used by CobaltStrike

Read More
CobaltStrike Named Pipe Pattern Regex

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

Detects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles

Read More
CobaltStrike Named Pipe Patterns

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 stp.1k ·
Share on:

Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles

Read More
CodeIntegrity - Blocked Image Load With Revoked Certificate

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects blocked image load events with revoked certificates by code integrity.

Read More
CodeIntegrity - Disallowed File For Protected Processes Has Been Blocked

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects block events for files that are disallowed by code integrity for protected processes

Read More
CodeIntegrity - Revoked Image Loaded

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects image load events with revoked certificates by code integrity.

Read More
CodeIntegrity - Revoked Kernel Driver Loaded

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects the load of a revoked kernel driver

Read More
CodeIntegrity - Unmet WHQL Requirements For Loaded Kernel Module

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects loaded kernel modules that did not meet the WHQL signing requirements.

Read More
CodeIntegrity - Unsigned Image Loaded

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects loaded unsigned image on the system

Read More
CodeIntegrity - Unsigned Kernel Module Loaded

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects the presence of a loaded unsigned kernel module on the system.

Read More
DiagTrackEoP Default Login Username

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects the default "UserName" used by the DiagTrackEoP POC

Read More
Driver Load From A Temporary Directory

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects a driver load from a temporary directory

Read More
Enabling COR Profiler Environment Variables

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.012 ·
Share on:

Detects .NET Framework CLR and .NET Core CLR "cor_enable_profiling" and "cor_profiler" variables being set and configured.

Read More
Function Call From Undocumented COM Interface EditionUpgradeManager

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects function calls from the EditionUpgradeManager COM interface. Which is an interface that is not used by standard executables.

Read More
Github New Secret Created

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access attack.t1078.004 ·
Share on:

Detects when a user creates action secret for the organization, environment, codespaces or repository.

Read More
Github Self Hosted Runner Changes Detected

Aug 12, 2024 · attack.impact attack.discovery attack.collection attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access attack.t1526 attack.t1213.003 attack.t1078.004 ·
Share on:

A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com. This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected, it should be validated from GitHub UI because the log entry may not provide full context.

Read More
Google Cloud Kubernetes CronJob

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.execution ·
Share on:

Identifies when a Google Cloud Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

Read More
HackTool - CrackMapExec Execution

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.credential-access attack.discovery attack.t1047 attack.t1053 attack.t1059.003 attack.t1059.001 attack.t1110 attack.t1201 ·
Share on:

This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.

Read More
HackTool - Default PowerSploit/Empire Scheduled Task Creation

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.s0111 attack.g0022 attack.g0060 car.2013-08-001 attack.t1053.005 attack.t1059.001 ·
Share on:

Detects the creation of a schtask via PowerSploit or Empire Default Configuration.

Read More
HackTool - DiagTrackEoP Default Named Pipe

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects creation of default named pipe used by the DiagTrackEoP POC, a tool that abuses "SeImpersonate" privilege.

Read More
HackTool - Empire PowerShell UAC Bypass

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 car.2019-04-001 ·
Share on:

Detects some Empire PowerShell UAC bypass methods

Read More
HackTool - Powerup Write Hijack DLL

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.001 ·
Share on:

Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation. In it's default mode, it builds a self deleting .bat file which executes malicious command. The detection rule relies on creation of the malicious bat file (debug.bat by default).

Read More
HackTool - SharpImpersonation Execution

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1134.001 attack.t1134.003 ·
Share on:

Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

Read More
Huawei BGP Authentication Failures

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects BGP failures which may be indicative of brute force attacks to manipulate routing.

Read More
Important Scheduled Task Deleted/Disabled

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.persistence attack.t1053.005 ·
Share on:

Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities

Read More
Impossible Travel

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second.

Read More
Juniper BGP Missing MD5

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation attack.defense-evasion attack.credential-access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.

Read More
LiveKD Driver Creation

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation ·
Share on:

Detects the creation of the LiveKD driver, which is used for live kernel debugging

Read More
LiveKD Driver Creation By Uncommon Process

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation ·
Share on:

Detects the creation of the LiveKD driver by a process image other than "livekd.exe".

Read More
LiveKD Kernel Memory Dump File Created

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation ·
Share on:

Detects the creation of a file that has the same name as the default LiveKD kernel memory dump.

Read More
Loading of Kernel Module via Insmod

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1547.006 ·
Share on:

Detects loading of kernel modules with insmod command. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. Adversaries may use LKMs to obtain persistence within the system or elevate the privileges.

Read More
MacOS Emond Launch Daemon

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.014 ·
Share on:

Detects additions to the Emond Launch Daemon that adversaries may use to gain persistence and elevate privileges.

Read More
Malicious Named Pipe Created

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

Detects the creation of a named pipe seen used by known APTs or malware.

Read More
Malware Shellcode in Verclsid Target Process

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 detection.emerging-threats ·
Share on:

Detects a process access to verclsid.exe that injects shellcode from a Microsoft Office application / VBA macro

Read More
Mavinject Inject DLL Into Running Process

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055.001 attack.t1218.013 ·
Share on:

Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag

Read More
Modify Group Policy Settings

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1484.001 ·
Share on:

Detect malicious GPO modifications can be used to implement many other malicious behaviors.

Read More
Modify Group Policy Settings - ScriptBlockLogging

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1484.001 ·
Share on:

Detect malicious GPO modifications can be used to implement many other malicious behaviors.

Read More
Modify User Shell Folders Startup Value

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1547.001 ·
Share on:

Detect modification of the startup key to a path where a payload could be stored to be launched during startup

Read More
Moriya Rootkit - System

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report

Read More
Moriya Rootkit File Created

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 detection.emerging-threats ·
Share on:

Detects the creation of a file named "MoriyaStreamWatchmen.sys" in a specific location. This filename was reported to be related to the Moriya rootkit as described in the securelist's Operation TunnelSnake report.

Read More
New Country

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent locations.

Read More
New Service Creation Using PowerShell

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects the creation of a new service using powershell.

Read More
Nimbuspwn Exploitation

Aug 12, 2024 · attack.privilege-escalation attack.t1068 ·
Share on:

Detects exploitation of Nimbuspwn privilege escalation vulnerability (CVE-2022-29799 and CVE-2022-29800)

Read More
OMIGOD HTTP No Authentication RCE

Aug 12, 2024 · attack.privilege-escalation attack.initial-access attack.execution attack.lateral-movement attack.t1068 attack.t1190 attack.t1203 attack.t1021.006 attack.t1210 ·
Share on:

Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request. Verify, successful, exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP). Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.

Read More
OMIGOD SCX RunAsProvider ExecuteScript

Aug 12, 2024 · attack.privilege-escalation attack.initial-access attack.execution attack.t1068 attack.t1190 attack.t1203 ·
Share on:

Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell. Script being executed gets created as a temp file in /tmp folder with a scx* prefix. Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/. The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

Read More
OMIGOD SCX RunAsProvider ExecuteShellCommand

Aug 12, 2024 · attack.privilege-escalation attack.initial-access attack.execution attack.t1068 attack.t1190 attack.t1203 ·
Share on:

Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

Read More
Password Provided In Command Line Of Net.EXE

Aug 12, 2024 · attack.defense-evasion attack.initial-access attack.persistence attack.privilege-escalation attack.lateral-movement attack.t1021.002 attack.t1078 ·
Share on:

Detects a when net.exe is called with a password in the command line

Read More
Path To Screensaver Binary Modified

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.002 ·
Share on:

Detects value modification of registry key containing path to binary used as screensaver.

Read More
Possible Coin Miner CPU Priority Param

Aug 12, 2024 · attack.privilege-escalation attack.t1068 ·
Share on:

Detects command line parameter very often used with coin miners

Read More
Potential Access Token Abuse

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1134.001 stp.4u ·
Share on:

Detects potential token impersonation and theft. Example, when using "DuplicateToken(Ex)" and "ImpersonateLoggedOnUser" with the "LOGON32_LOGON_NEW_CREDENTIALS flag".

Read More
Potential CVE-2023-21554 QueueJumper Exploitation

Aug 12, 2024 · attack.privilege-escalation attack.execution cve.2023-21554 detection.emerging-threats ·
Share on:

Detects potential exploitation of CVE-2023-21554 (dubbed QueueJumper)

Read More
Potential Dridex Activity

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 attack.discovery attack.t1135 attack.t1033 detection.emerging-threats ·
Share on:

Detects potential Dridex acitvity via specific process patterns

Read More
Potential Persistence Via GlobalFlags

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1546.012 car.2013-01-002 ·
Share on:

Detects registry persistence technique using the GlobalFlags and SilentProcessExit keys

Read More
Potential Persistence Via Netsh Helper DLL

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.007 attack.s0108 ·
Share on:

Detects the execution of netsh with "add helper" flag in order to add a custom helper DLL. This technique can be abused to add a malicious helper DLL that can be used as a persistence proxy that gets called when netsh.exe is executed.

Read More
Potential Persistence Via PowerShell User Profile Using Add-Content

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.013 ·
Share on:

Detects calls to "Add-Content" cmdlet in order to modify the content of the user profile and potentially adding suspicious commands for persistence

Read More
Potential Persistence Via Security Descriptors - ScriptBlock

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation ·
Share on:

Detects usage of certain functions and keywords that are used to manipulate security descriptors in order to potentially set a backdoor. As seen used in the DAMP project.

Read More
Potential Privilege Escalation Attempt Via .Exe.Local Technique

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation ·
Share on:

Detects potential privilege escalation attempt via the creation of the "*.Exe.Local" folder inside the "System32" directory in order to sideload "comctl32.dll"

Read More
Potential Privilege Escalation Using Symlink Between Osk and Cmd

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.008 ·
Share on:

Detects the creation of a symbolic link between "cmd.exe" and the accessibility on-screen keyboard binary (osk.exe) using "mklink". This technique provides an elevated command prompt to the user from the login screen without the need to log in.

Read More
Potential Shim Database Persistence via Sdbinst.EXE

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.011 ·
Share on:

Detects installation of a new shim using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims

Read More
Potential SystemNightmare Exploitation Attempt

Aug 12, 2024 · attack.privilege-escalation attack.t1068 detection.emerging-threats ·
Share on:

Detects an exploitation attempt of SystemNightmare in order to obtain a shell as LOCAL_SYSTEM

Read More
Potentially Suspicious Event Viewer Child Process

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 car.2019-04-001 ·
Share on:

Detects uncommon or suspicious child processes of "eventvwr.exe" which might indicate a UAC bypass attempt

Read More
PowerShell Profile Modification

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.013 ·
Share on:

Detects the creation or modification of a powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence

Read More
PowerShell ShellCode

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 attack.execution attack.t1059.001 ·
Share on:

Detects Base64 encoded Shellcode

Read More
Process Explorer Driver Creation By Non-Sysinternals Binary

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1068 ·
Share on:

Detects creation of the Process Explorer drivers by processes other than Process Explorer (procexp) itself. Hack tools or malware may use the Process Explorer driver to elevate privileges, drops it to disk for a few moments, runs a service using that driver and removes it afterwards.

Read More
Process Monitor Driver Creation By Non-Sysinternals Binary

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1068 ·
Share on:

Detects creation of the Process Monitor driver by processes other than Process Monitor (procmon) itself.

Read More
PSEXEC Remote Execution File Artefact

Aug 12, 2024 · attack.lateral-movement attack.privilege-escalation attack.execution attack.persistence attack.t1136.002 attack.t1543.003 attack.t1570 attack.s0029 ·
Share on:

Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the file system and will be recorded in the USN Journal on the target system

Read More
PUA - AdvancedRun Execution

Aug 12, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1564.003 attack.t1134.002 attack.t1059.003 ·
Share on:

Detects the execution of AdvancedRun utility

Read More
PUA - AdvancedRun Suspicious Execution

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1134.002 ·
Share on:

Detects the execution of AdvancedRun utility in the context of the TrustedInstaller, SYSTEM, Local Service or Network Service accounts

Read More
PUA - Wsudo Suspicious Execution

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.t1059 ·
Share on:

Detects usage of wsudo (Windows Sudo Utility). Which is a tool that let the user execute programs with different permissions (System, Trusted Installer, Administrator...etc)

Read More
Renamed Mavinject.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055.001 attack.t1218.013 ·
Share on:

Detects the execution of a renamed version of the "Mavinject" process. Which can be abused to perform process injection using the "/INJECTRUNNING" flag

Read More
Rundll32 Registered COM Objects

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.015 ·
Share on:

load malicious registered COM objects

Read More
Scheduled Cron Task/Job - Linux

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.t1053.003 ·
Share on:

Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.

Read More
Scheduled Cron Task/Job - MacOs

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.t1053.003 ·
Share on:

Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.

Read More
Scheduled Task Creation Via Schtasks.EXE

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.t1053.005 attack.s0111 car.2013-08-001 stp.1u ·
Share on:

Detects the creation of scheduled tasks by user accounts via the "schtasks" utility.

Read More
Security Privileges Enumeration Via Whoami.EXE

Aug 12, 2024 · attack.privilege-escalation attack.discovery attack.t1033 ·
Share on:

Detects a whoami.exe executed with the /priv command line flag instructing the tool to show all current user privileges. This is often used after a privilege escalation attempt.

Read More
Service DACL Abuse To Hide Services Via Sc.EXE

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detects usage of the "sc.exe" utility adding a new service with special permission seen used by threat actors which makes the service hidden and unremovable.

Read More
Service Installation in Suspicious Folder

Aug 12, 2024 · attack.persistence attack.privilege-escalation car.2013-09-005 attack.t1543.003 ·
Share on:

Detects service installation in suspicious folder appdata

Read More
Service Installation with Suspicious Folder Pattern

Aug 12, 2024 · attack.persistence attack.privilege-escalation car.2013-09-005 attack.t1543.003 ·
Share on:

Detects service installation with suspicious folder patterns

Read More
Service Registry Key Read Access Request

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.011 ·
Share on:

Detects "read access" requests on the services registry key. Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts.

Read More
Service Security Descriptor Tampering Via Sc.EXE

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detection of sc.exe utility adding a new service with special permission which hides that service.

Read More
Shell Process Spawned by Java.EXE

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation ·
Share on:

Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation)

Read More
SOURGUM Actor Behaviours

Aug 12, 2024 · attack.t1546 attack.t1546.015 attack.persistence attack.privilege-escalation detection.emerging-threats ·
Share on:

Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM

Read More
Standard User In High Privileged Group

Aug 12, 2024 · attack.credential-access attack.privilege-escalation ·
Share on:

Detect standard users login that are part of high privileged groups such as the Administrator group

Read More
Startup Item File Created - MacOS

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1037.005 ·
Share on:

Detects the creation of a startup item plist file, that automatically get executed at boot initialization to establish persistence. Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.

Read More
Sticky Key Like Backdoor Execution

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.008 car.2014-11-003 car.2014-11-008 ·
Share on:

Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen

Read More
Sticky Key Like Backdoor Usage - Registry

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.008 car.2014-11-003 car.2014-11-008 ·
Share on:

Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen

Read More
Suspect Svchost Activity

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·
Share on:

It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious process spawns the process and injects code into the process memory space.

Read More
Suspicious Browser Activity

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser

Read More
Suspicious Child Process Of SQL Server

Aug 12, 2024 · attack.t1505.003 attack.t1190 attack.initial-access attack.persistence attack.privilege-escalation ·
Share on:

Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.

Read More
Suspicious Child Process Of Veeam Dabatase

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation ·
Share on:

Detects suspicious child processes of the Veeam service process. This could indicate potential RCE or SQL Injection.

Read More
Suspicious Debugger Registration Cmdline

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.008 ·
Share on:

Detects the registration of a debugger for a program that is available in the logon screen (sticky key backdoor).

Read More
Suspicious GetTypeFromCLSID ShellExecute

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1546.015 ·
Share on:

Detects suspicious Powershell code that execute COM Objects

Read More
Suspicious New Service Creation

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects creation of a new service via "sc" command or the powershell "new-service" cmdlet with suspicious binary paths

Read More
Suspicious NTLM Authentication on the Printer Spooler Service

Aug 12, 2024 · attack.privilege-escalation attack.credential-access attack.t1212 ·
Share on:

Detects a privilege elevation attempt by coercing NTLM authentication on the Printer Spooler service

Read More
Suspicious Processes Spawned by WinRM

Aug 12, 2024 · attack.t1190 attack.initial-access attack.persistence attack.privilege-escalation ·
Share on:

Detects suspicious processes including shells spawnd from WinRM host process

Read More
Suspicious RunAs-Like Flag Combination

Aug 12, 2024 · attack.privilege-escalation ·
Share on:

Detects suspicious command line flags that let the user set a target user and command as e.g. seen in PsExec-like tools

Read More
Suspicious Scheduled Task Creation

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.persistence attack.t1053.005 ·
Share on:

Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc.

Read More
Suspicious Scheduled Task Update

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.persistence attack.t1053.005 ·
Share on:

Detects update to a scheduled task event that contain suspicious keywords.

Read More
Suspicious Service DACL Modification Via Set-Service Cmdlet - PS

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574.011 ·
Share on:

Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

Read More
Suspicious Service Installation

Aug 12, 2024 · attack.persistence attack.privilege-escalation car.2013-09-005 attack.t1543.003 ·
Share on:

Detects suspicious service installation commands

Read More
Suspicious Service Path Modification

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1543.003 ·
Share on:

Detects service path modification via the "sc" binary to a suspicious command or path

Read More
Suspicious Shells Spawn by Java Utility Keytool

Aug 12, 2024 · attack.initial-access attack.persistence attack.privilege-escalation ·
Share on:

Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)

Read More
Triple Cross eBPF Rootkit Execve Hijack

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation ·
Share on:

Detects execution of a the file "execve_hijack" which is used by the Triple Cross rootkit as a way to elevate privileges

Read More
UAC Bypass Abusing Winsat Path Parsing - File

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

Read More
UAC Bypass Abusing Winsat Path Parsing - Registry

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

Read More
UAC Bypass Using .NET Code Profiler on MMC

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using .NET Code Profiler and mmc.exe DLL hijacking (UACMe 39)

Read More
UAC Bypass Using Consent and Comctl32 - File

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)

Read More
UAC Bypass Using Event Viewer RecentViews

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation ·
Share on:

Detects the pattern of UAC Bypass using Event Viewer RecentViews

Read More
UAC Bypass Using EventVwr

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation ·
Share on:

Detects the pattern of a UAC bypass using Windows Event Viewer

Read More
UAC Bypass Using IDiagnostic Profile - File

Aug 12, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the creation of a file by "dllhost.exe" in System32 directory part of "IDiagnosticProfileUAC" UAC bypass technique

Read More
UAC Bypass Using IEInstal - File

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)

Read More
UAC Bypass Using Iscsicpl - ImageLoad

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the "iscsicpl.exe" UAC bypass technique that leverages a DLL Search Order hijacking technique to load a custom DLL's from temp or a any user controlled location in the users %PATH%

Read More
UAC Bypass Using MSConfig Token Modification - File

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)

Read More
UAC Bypass Using NTFS Reparse Point - File

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)

Read More
UAC Bypass Using Windows Media Player - File

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)

Read More
UAC Bypass Using Windows Media Player - Registry

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)

Read More
UAC Bypass Using WOW64 Logger DLL Hijack

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using a WoW64 logger DLL hijack (UACMe 30)

Read More
UAC Bypass via Event Viewer

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 car.2019-04-001 ·
Share on:

Detects UAC bypass method using Windows event viewer

Read More
UAC Bypass via ICMLuaUtil

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Detects the pattern of UAC Bypass using ICMLuaUtil Elevated COM interface

Read More
UAC Bypass via Sdclt

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 car.2019-04-001 ·
Share on:

Detects the pattern of UAC Bypass using registry key manipulation of sdclt.exe (e.g. UACMe 53)

Read More
UAC Bypass Via Wsreset

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·
Share on:

Unfixed method for UAC bypass from Windows 10. WSReset.exe file associated with the Windows Store. It will run a binary file contained in a low-privilege registry.

Read More
UAC Disabled

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·
Share on:

Detects when an attacker tries to disable User Account Control (UAC) by setting the registry value "EnableLUA" to 0.

Read More
Uncommon Extension Shim Database Installation Via Sdbinst.EXE

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.011 ·
Share on:

Detects installation of a potentially suspicious new shim with an uncommon extension using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims

Read More
Uncommon One Time Only Scheduled Task At 00:00

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.t1053.005 ·
Share on:

Detects scheduled task creation events that include suspicious actions, and is run once at 00:00

Read More
Uncommon Service Installation Image Path

Aug 12, 2024 · attack.persistence attack.privilege-escalation car.2013-09-005 attack.t1543.003 ·
Share on:

Detects uncommon service installation commands by looking at suspicious or uncommon image path values containing references to encoded powershell commands, temporary paths, etc.

Read More
Unfamiliar Sign-In Properties

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·
Share on:

Detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look for anomalous sign-ins.

Read More
User Added To Root/Sudoers Group Using Usermod

Aug 12, 2024 · attack.privilege-escalation attack.persistence ·
Share on:

Detects usage of the "usermod" binary to add users add users to the root or suoders groups

Read More
VsCode Powershell Profile Modification

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.013 ·
Share on:

Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence

Read More
Windows Kernel Debugger Execution

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation ·
Share on:

Detects execution of the Windows Kernel Debugger "kd.exe".

Read More
WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load

Aug 12, 2024 · attack.lateral-movement attack.privilege-escalation attack.persistence attack.t1546.003 ·
Share on:

Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity.

Read More
WMI Persistence

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.003 ·
Share on:

Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.

Read More
WMI Persistence - Script Event Consumer

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.003 ·
Share on:

Detects WMI script event consumers

Read More
WMI Persistence - Security

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.003 ·
Share on:

Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.

Read More